ISMS Controls

The ISO 27001 standard recommends taking a risk-based approach to information security. Organizations must identify and address information security threats by establishing controls as a result of this.

The measures are detailed in Annex A of the standard. In Annex A of the ISO 27001 standard, there are 93 controls separated into 4 groups – A.5 through A.8. The implementation of all 93 controls is not required, and only a small number of them are mandatory to be recorded. It is up to the company to determine what to implement and what not to, based on their risk management methodology. This freedom of choice allows businesses to focus on the controls that are most important to them rather than wasting money on those that aren’t. The applicable controls are defined in the Statement of Applicability (SoA).

ISO 27001’s Annex A simply provides a one-sentence description of each control, giving you a sense of what the goal is or what needs to be...

ISO 27001 versus 27002

ISO/IEC 27002 provides guidance on how to implement the security controls in Annex A of ISO 27001, the international standard for an Information Security Management System (ISMS). The ISO 27000 series is a collection of documents pertaining to various aspects of information security management. ISO 27001 is the fundamental framework in which the implementation requirements for an ISMS can be found. Basically, this is a list of everything you need to do in order to be compliant. Although ISO 27002 is a more comprehensive standard, no organization can be accredited to it as it is not a management standard. It is a collection of requirements for businesses to manage their policies and processes so that they can achieve a certain set of outcomes. It essentially lays down the rules for operating a system. In the case of ISO 27001, it defines the ISMS, and therefore certification against ISO 27001 is possible.

Information security must be designed, executed, monitored...

Annex A controls

The Annex A controls are from A.5 through A.8. There are 4 control sets/domains, and a total of 93 controls in Annex A. Let’s see in detail what each control domain in Annex A is.

A.5 – organizational controls

Organizational controls include the management and governance structure that supports and guides the implementation and operation of information security within the organization. This structure encompasses the roles, responsibilities, policies, and procedures that create the organizational backbone for achieving the company’s information security goals. The main aim of these controls is to establish standards, measure performance, compare performance to those standards, and take necessary corrective action to ensure that the organization’s security posture aligns with its objectives and policies. This category emphasizes the importance of leadership, strategic planning, and organizational structure in ensuring comprehensive information...

Summary

ISO 27002 is a code of practice for the controls of an ISMS, and it goes into far more detail than ISO 27001’s Annex A controls. The list of 93 controls, divided into 4 control sets, is expanded in clauses A.5 to A.8 of ISO 27002:2022.

While ISO 27002 is not a certifiable standard in and of itself, following its information security management principles will help the company satisfy ISO 27001 certification requirements. It explains how to comply with the ISO 27001 standard and how to implement it.

Because there is no one-size-fits-all information security solution, the appropriate information security controls must be decided on based on their risk assessment and appropriate controls. The CIA triad can be used to define information security in this context.

In the upcoming chapter, we will see one of the most significant aspects of the entire information security auditing process – risk management. The important steps of identifying, analyzing, measuring...