ISO/IEC 27002: The 93 Information Security Controls

Name: ISO/IEC 27002: The 93 Information Security Controls
Rating: 4.4 (1603 reviews)

All 93 ISMS controls explained — organizational, people, physical and technological — for ISO/IEC 27001 implementation

Created byCristian Vlad Lupa, rigcert.education

Last updated 7/2026

English

Arabic [Auto],German [Auto],

What you'll learn

Implement an effective information security programme
Determine and apply appropriate security controls
Achieve compliance with ISO/IEC 27001
Understand information security best practices
Manage information security risks

Course content

6 sections • 105 lectures • 6h 51m total length

Introduction3:17
Explore ISO/IEC 27002:2022 guidelines for 93 information security controls. See how these controls span organizational, people, physical, and technological domains, including incident management, classification and labeling, and cryptography.
Information security, cybersecurity and privacy4:12
About the three concepts: information security, cybersecurity and privacy. The CIA triad (Confidentiality, Integrity, Availability).
The ISO/IEC 27000 series of standards4:35
About the standards in the ISO/IEC 27000 series of standards. Which are the most popular standards in this family and what is their purpose.
Standards on information security you can find here: https://www.iso.org/committee/45306/x/catalogue/p/1/u/0/w/0/d/0
An ISMS according to ISO/IEC 270013:53
What is a management system and what is an ISMS (Information Security Management System). What does an ISMS consist of. What is the purpose of ISO/IEC 27001 and ISO/IEC 27002.
About ISO/IEC 270027:21
A short history of ISO/IEC 27002. The structure of the standard. The four categories of controls (or themes): Organizational controls, People controls, Physical controls and Technological controls. About the attributes associated to each control in the standard.

Policies for information security6:30
About the need to establish an information security policy supported by topic-specific policies that address specific aspects.
Information security roles and responsibilities3:35
About the structure (or individuals) tasked to coordinate information security management in an organization.
Segregation of duties2:56
About the need to segregate (or to separate) conflicting duties and areas of responsibility (with examples).
Management responsibilities2:57
About the support of the top management for the ISMS and the need to require everyone in the organization to follow the information security policy and topic-specific policies.
Contact with authorities1:53
About the need for the organization to maintain contact with relevant authorities.
Contact with special interest groups2:14
About the need and the benefits of maintaining contacts with interest groups, information security forums and professional associations.
Threat intelligence3:11
About collecting and analyzing information about security threats, in order to produce threat intelligence.
Information security in project management4:29
About the need to integrate information security into all projects, regardless of their specific or size.
Inventory of information and other associated assets5:59
About how to develop and maintain an inventory of information and associated assets.
Acceptable use of information and other associated assets2:48
About the need to identify, document and implement rules for the acceptable use of information and assets.
Return of assets2:41
About the process of returning assets belonging to the organization when the employment or contract is terminated or changed.
Classification of information5:16
About the classification of information. Different information classification schemes. The recommendation for a topic-specific policy on information classification.
Labelling of information2:22
About the labelling of information in accordance with its classification.
Information transfer5:10
About the rules for transferring information with external parties, using electronic means, physical media and the verbal transfer of information.
Access control8:48
About the recommendation to define rules and a topic-specific policy on access control. Details about different access control methodologies.
Identity management2:52
About the solutions to ensure that individuals and systems who access information and associated assets are identified and access rights are assigned appropriately.
Authentication information5:52
About the need to control the allocation and management of authentication information. User awareness on the appropriate handling of authentication information.
Access rights4:02
About provisioning, reviewing, modifying and removing access rights to information and associated assets.
Information security in supplier relationships6:02
About managing the information security risks associated with the use of suppliers' products and services.
Addressing information security within supplier agreements6:24
About the need to agree with each supplier the relevant information security requirements depending on the type of relationship.
Managing information security in the ICT supply chain3:26
About the need to have processes and procedures to address information security risks associated with the ICT supply chain.
Monitoring, review and change management of supplier services3:30
About the need to monitor, review, evaluate and manage changes in supplier information security practices and the delivery of services to the organization.
Information security for use of cloud services5:45
About the need to establish processes to address information security when acquiring, using or exiting from cloud services.
Information security incident management planning and preparation5:16
About the processes to manage information security incidents. The difference between security events and incidents.
Assessment and decision on information security events2:13
About the need to assess information security events to decide if they represents incidents or not.
Response to information security incidents2:55
About the response that the organization should provide to information security incidents.
Learning from information security incidents1:32
About the need to use the information collected while managing security incidents for education purposes.
Collection of evidence3:21
About the need to have procedures for the identification, collection, acquisition and preservation of information that may be used as evidence in the investigation of information security incidents.
Information security during disruption2:53
About the need to have arrangements in place to maintain an adequate level of information security in case of major incident.
ICT readiness for business continuity4:37
About planning, maintaining and testing the ICT readiness based on the organization's business continuity objectives.
Legal, statutory, regulatory and contractual requirements3:14
About the identification of legal, regulatory and contractual requirements relevant for information security and the approach of the organization to ensure compliance.
Intellectual property rights2:43
About the need to have procedures and rules to protect intellectual property rights.
Protection of records2:13
About the rules to protect records from loss, destruction, falsification, unauthorized access and release.
Privacy and protection of PII2:54
About the need to comply to the requirements for privacy and the protection of personally identifiable information.
Independent review of information security2:32
About the need to arrange independent reviews of the organization's approach to manage information security.
Conformance with policies, rules and standards for information security1:59
About the process to review conformance with the information security policy and topic-specific policies.
Documented operating procedures3:57
About the need to document and implement procedures for operating information processing facilities.
Recapitulation organizational controls7:22
A brief recapitulation of the organizational controls in ISO/IEC 27002.
Organizational controls

Screening5:07
About the background checks that the organization should perform on all candidates for employment, before they join the organization.
Terms and conditions of employment2:57
About information security responsibilities that should be included in the terms and conditions for employment.
Information security awareness, education and training4:41
About the need for the organization to ensure that its personnel receive adequate training and awareness on information security.
Disciplinary process2:12
About the process that should be applied in case personnel do not comply with information security requirements.
Responsibilities after termination or change of employment3:14
About the responsibilities and duties that refer to information security and that remain valid after the employment is terminated or changed.
Confidentiality or non-disclosure agreements2:50
About the need for the personnel to sign confidentiality or non-disclosure agreements.
Remote working4:38
About the conditions and the risks associated with working from premises outside the control of the organization.
Information security event reporting3:13
About the need for personnel to report immediately any observed or suspected information security events.
Recapitulation people controls2:00
A recapitulation of the controls that refer to the persons working for, or on behalf, of the organization.
People controls

Physical security perimeters3:56
About defining and using security perimeters to protect areas where sensitive information and assets are located.
Physical entry5:31
About protecting secure areas with entry controls.
Securing offices, rooms and facilities1:06
About the security measures to protect offices, rooms and facilities.
Physical security monitoring2:32
About the need to monitor premises continuously to detect unauthorized physical access.
Protecting against physical and environmental threats3:12
About the controls intended to protect against natural disasters, intentional and unintentional physical threats to infrastructure.
Working in secure areas1:53
About secure areas and the controls for working in secure areas.
Clear desk and clear screen3:01
About the rules that should be enforced to ensure clear desks and clear screens.
Equipment siting and protection3:10
About siting and protecting equipment.
Security of assets off-premises3:08
About the security measures that should be implemented to protect assets taken outside the organization's assets.
Storage media5:44
About the measures intended to manage storage media throughout its life cycle.
Supporting utilities2:40
About protecting processing facilities from power failures and other disruptions.
Cabling security2:01
About protecting power and telecommunication cables from interception, interference and damage.
Equipment maintenance2:48
About the measure to ensure that equipment is maintained correctly.
Secure disposal or re-use of equipment3:10
About the security measures needed when equipment is disposed of or used for other purposes in the organization.
Recapitulation physical controls2:32
A recapitulation of the security controls that refer to physical objects.
Physical controls

User endpoint devices7:10
Guidelines for using endpoint devices. User awareness. Guidelines for using personal devices for work purposes (BYOD - Bring Your Own Device).
Privileged access rights4:17
About restricting and managing the allocation and use of privileged access rights.
Information access restriction3:00
Guidelines for restricting the access to information and associated assets.
Access to source code2:14
About the need to manage properly read and write access to source code and development tools.
Secure authentication4:56
Guidelines for the log-on procedures and technologies.
Capacity management3:14
About the monitoring of resources and the predicting future needs to ensure sufficient availability.
Protection against malware3:48
Guidelines for protecting against malware, including the awareness of users on the risks involved.
Management of technical vulnerabilities6:51
About the need to obtain and to review in time information about technical vulnerabilities.
Configuration management4:05
About the need to establish configurations (including configurations) to ensure that software, hardware, services and networks are in a consistent state and any unauthorized or incorrect changes are prevented.
Information deletion3:44
Guidelines on protecting information from unnecessary exposure with deletion.
Data masking3:43
Guidelines on protecting sensitive data (including PII) with masking techniques. About pseudonymization and anonymization.
Data leakage prevention3:47
Guidelines for what to consider for data leakage prevention solutions.
Information backup4:28
About taking, protecting and testing regularly backup copies of information, software and systems.
Redundancy of information processing facilities4:07
Guidelines on how to ensure sufficient redundancy for information processing facilities to meet availability needs.
Logging6:06
Guidelines on producing, protecting, storing and analyzing logs that record activities, exceptions, faults and other relevant events.
Monitoring activities4:01
Guidelines on how the organization should monitor systems, networks and applications for anomalous behavior and take appropriate actions to address security incidents.
Clock synchronization2:05
About the need to synchronize the clocks of information processing systems. Reasons and solutions.
Use of privileged utility programs2:19
About restricting and controlling the use of utility programs that can override system and application controls.
Installation of software on operational systems3:24
Guidelines on the procedures and measures to manage the installation of software on operational systems.
Networks security4:40
Generic guidelines to consider in order to protect networks and network devices and information in systems and applications.
Security of network services3:14
About the need to establish security mechanisms, service levels and service requirements for network services provided to the organization by third parties.
Segregation of networks2:53
Guidelines to consider for improved performance and security by splitting networks into separate domains.
Web filtering3:07
Guidelines on managing the exposure to malicious content associated with the access of personnel to external websites.
Use of cryptography6:32
Guidelines on using cryptography and on the management of cryptographic keys.
Secure development life cycle3:30
Guidelines on the rules to be considered for the secure development of software and systems.
Application security requirements6:59
Guidelines for specifying information security requirements when the organization develops or if it acquires applications.
Secure system architecture and engineering principles7:14
About the need to develop and to apply security engineering principles to all system development activities.
Secure coding5:13
Guidelines on establishing and applying principles for secure coding in software development.
Security testing in development and acceptance3:09
Guidelines on defining and implementing security testing processes in the development life cycle.
Outsourced development4:05
About aspects to consider when the organization decides to outsource system development.
Separation of development, test and production environments4:01
About the need to ensure a separation between development, testing and production environments. Reasons, solutions and exceptions.
Change management2:25
Generic information about managing changes to information systems and information processing facilities, so that information security is not negatively affected.
Test information2:32
About the need to protect the information used for testing purposes.
Protection of information systems during audit testing3:30
Guidelines for protecting operational systems during audits and other assurance activities that the organization intends to perform.
Recapitulation technological controls6:51
A recapitulation of the technological controls in ISO/IEC 27002.
Technological controls

The certification to ISO/IEC 27001 and ISO/IEC 270024:15
About the certification of organizations and individuals in the field of information security management.
Thank you and good bye!2:35
Explore how ISO/IEC 27002 guides information security controls across organizational, human resources, technology, and physical security, and learn how to pursue certification and access the course materials.
Bonus lecture - My other courses on information security management8:02
A presentation of my other courses on information security management as well as the content available at rigcert.education

Requirements

Familiarity with the ISO/IEC 27000 framework is useful, but not mandatory
An understanding of information security management principles

Description

ISO/IEC 27002 is the international standard that explains the 93 information security controls of ISO/IEC 27001 — what each control means, what it is for, and how it can be implemented. Where ISO/IEC 27001 lists the controls (in its Annex A), ISO/IEC 27002 is the implementation guidance: the reference every ISMS implementer, security officer and auditor works with daily.

This course details all 93 controls, organized by the four themes of the standard.

Course structure

Introduction — the ISO/IEC 27000 family of standards, the position and purpose of ISO/IEC 27002, definitions of information security, cybersecurity and privacy, and what an information security management system (ISMS) consists of
The 37 organizational controls — including information security roles and responsibilities, segregation of duties, threat intelligence, information security in project management, information classification and labelling, access control, information transfer, supplier relationships, ICT continuity, privacy and protection of PII, and documented operating procedures
The 8 people controls — screening, terms and conditions of employment, security awareness and training, the disciplinary process, and remote working
The 14 physical controls — secure areas, physical entry controls, clear desk and clear screen, storage media, supporting utilities, and the secure re-use and disposal of equipment
The 34 technological controls — endpoint devices, data masking, information deletion, backup, cryptography, logging and monitoring, network security, secure development and secure coding, protection of test information, web filtering, secure authentication, access to source code, and privileged utility programs
Certification — how ISO/IEC 27001 certification works for organizations, and the certification paths available to individuals working with ISO/IEC 27001 and 27002

How this course relates to ISO/IEC 27001

ISO/IEC 27001 sets the requirements for an ISMS and is the standard organizations certify against; ISO/IEC 27002 provides the detailed guidance for implementing its controls. If you are implementing an ISMS, preparing for certification, or selecting controls for your Statement of Applicability (SoA), this course gives you the control-by-control understanding that ISO/IEC 27001 itself does not provide.

Who this course is for

ISMS implementers and information security officers selecting and implementing controls
IT and cybersecurity professionals mapping their technical work to ISO/IEC 27001 requirements
Internal auditors and consultants who need to understand what good control implementation looks like
Anyone preparing their organization for ISO/IEC 27001 certification

Who this course is for:

Information security managers
ISMS auditors and consultants
Information security management practitioners and enthusiasts
Cybersecurity and privacy practitioners
Those interested in the ISO 27k framework

ISO/IEC 27002: The 93 Information Security Controls

What you'll learn

Explore related topics

Course content

Introductory section5 lectures • 23min

Organizational controls38 lectures • 2hr 28min

People controls9 lectures • 31min

Physical controls15 lectures • 46min

Technological controls35 lectures • 2hr 27min

One or two more things ...3 lectures • 15min

Requirements

Description

Who this course is for: