ISO/IEC 27002
Information Security Controls
Understand the security controls organizations select, implement, and manage.
What ISO/IEC 27002 covers
ISO/IEC 27002 provides a reference set of information security controls, with guidance on how organizations can implement them.
The 2022 edition organizes its controls under four themes: organizational, people, physical, and technological.
It is closely connected with ISO/IEC 27001, whose control selection it supports, and it can also be used as practical guidance by organizations that are not pursuing an ISMS.
What you can build knowledge in
- Information security control themes and attributes.
- Organizational controls, policies, and responsibilities.
- People controls, awareness, and personnel practices.
- Physical security controls and secure environments.
- Technological controls, such as access, cryptography, logging, and secure development.
- Selecting, implementing, and reviewing controls based on risk.
Where it shows up at work
Selecting controls
Choosing controls that address identified risks and recording why they were selected.
Writing practical policy
Turning control guidance into policies and procedures that people can follow.
Reviewing control effectiveness
Checking whether controls work as intended across people, processes, and technology.
Who should explore it, and where it applies
Who Should Explore It?
Information security managers, cybersecurity practitioners, IT professionals, security consultants, GRC specialists, auditors, and professionals who select or evaluate security controls.
Professional Applications
Security control selection and implementation, ISMS support, control assessment, security policy development, assurance, and consulting.
Professional Pathways to Explore
- ISO/IEC 27002 Foundation
- Manager
- Lead Manager
Subject to current scheme availability.
Controls are most useful when professionals understand why they are selected and how they connect with risk, responsibilities, and organizational objectives.
Choose the right professional certification level
Different qualifications develop different kinds of professional knowledge. Choose according to your goals and experience.
Foundation — Establish Your Knowledge
Foundation-level training introduces the purpose, terminology, principles, structure, and fundamental concepts of a particular standard.
Best suited to: Professionals seeking a structured introduction before taking on specialist responsibilities.
Lead Manager and Advanced Professional Pathways
Certain disciplines offer Manager, Lead Manager, or other advanced qualifications. These may address professional responsibilities that are not limited to implementation or auditing.
Best suited to: Individuals developing management, advisory, specialist, or leadership responsibilities in the relevant discipline.
Important: Attending advanced training does not automatically qualify a candidate for the corresponding advanced credential. Every credential is governed by its specific eligibility requirements.
Your professional certification journey
Before investing in training, understand the steps involved and the outcomes you can reasonably expect.
- Step 1
Identify Your Professional Goal
Begin with your current responsibilities, relevant experience, and the knowledge you want to develop.
- Step 2
Select the Relevant Standard
Explore the standard's purpose, scope, practical applications, and relationship to your professional interests.
- Step 3
Choose an Appropriate Training Pathway
Compare Foundation, specialist, Manager, Lead Implementer, Lead Auditor, or other applicable options.
- Step 4
Confirm the Training Arrangements
Review the course title, edition, provider, delivery, fees, examination arrangements, and eligibility.
- Step 5
Complete the Training
Engage with the material, exercises, case studies, discussions, and assessments included in the offering.
- Step 6
Meet Examination Requirements
Where an examination is part of the scheme, satisfy the required assessment criteria.
- Step 7
Apply for the Appropriate Professional Credential
Where a PECB credential is available, submit the application and satisfy the scheme's conditions.
- Step 8
Maintain and Develop Your Expertise
Stay informed about revised standards, emerging risks, and continuing professional development requirements.
Confirm the training arrangements
Before enrolling, review:
- The exact course title and applicable standard edition.
- Training provider and credentialing organization.
- Delivery mode and schedule.
- Curriculum and learning materials.
- Training fees and what they include.
- Examination arrangements.
- Eligibility and experience requirements.
- Cancellation, rescheduling, and examination retake policies.
Arrangements can vary by program and provider.
Organizational Certification
An organization may obtain independent third-party certification to certain ISO management-system standards. The certificate concerns the organizational management system and its defined scope—not the personal qualifications of every employee.
Professional Certification
Individuals may pursue professional training, examinations, and credentials associated with ISO standards through certification bodies such as PECB. Depending on the scheme, these may recognize knowledge, qualifying experience, or other defined competencies.
Training Completion
Completing a training course demonstrates participation or successful course completion under the provider's rules. It does not necessarily establish eligibility for a professional credential.
Professional learning for organizations
INCYB welcomes enquiries from organizations interested in exploring standards-based professional learning for their employees and management teams.
Explore ISO Professional Learning for TeamsPotential Organizational Learning Formats
Depending on the confirmed offering, professional learning arrangements may include individual participation, group training, role-specific learning pathways, awareness sessions, and examination-oriented programs.
Actual delivery modes, schedules, course availability, trainer arrangements, and certification provisions must be confirmed for each engagement.
Your questions answered
Can I pursue ISO-related learning without a cybersecurity or IT background?
Yes.
ISO standards address many disciplines, including enterprise risk, compliance, quality, project management, manufacturing, occupational safety, food safety, environmental management, energy management, and sustainability.
Your existing professional background may be relevant to multiple pathways.
Which ISO qualification should cybersecurity professionals consider?
ISO/IEC 27001 is particularly relevant to information security management, implementation, and auditing.
ISO/IEC 27005 focuses on information security risk management.
ISO/IEC 27701, ISO/IEC 42001, and ISO 22301 may also be relevant to professionals interested in privacy, AI governance, and business continuity.
The best choice depends on the responsibilities you want to develop.
Does ISO directly certify professionals?
No. ISO develops and publishes international standards but does not directly award individual professional certifications.
Professional credentials relating to ISO standards may be issued by separate certification bodies under their applicable schemes.
Is PECB certification the same as organizational ISO certification?
No.
PECB professional certification concerns individuals who meet the requirements of a defined professional certification scheme.
Organizational ISO certification concerns the conformity of an organization's management system to the relevant standard.
Do I need professional experience before enrolling in an ISO training course?
Not necessarily.
Some Foundation courses are designed for individuals with limited prior knowledge, while advanced programs may recommend relevant experience.
Certification eligibility may require more experience than training participation. Always review the requirements for the specific program and credential.
Is passing a professional certification exam enough to become certified?
Not always.
Depending on the credential, successful candidates may also need to submit an application, demonstrate qualifying experience, document relevant projects or audits, and meet other certification scheme requirements.
Passing an examination does not automatically confer every available professional designation.
Are the courses based on the latest ISO editions?
Course edition alignment depends on the training provider, the specific course, and the release or transition status of the applicable certification scheme.
Before enrollment, confirm the exact edition addressed by the training and examination.
Are all 25 learning areas available as scheduled courses through INCYB?
The catalogue represents professional learning areas available for enquiry and exploration.
Individual courses, delivery formats, certification schemes, and schedules are subject to confirmation.
A listed topic should not be interpreted as a commitment that a particular course session or professional credential is currently available through INCYB.
Explore the other pathways
- 01ISO/IEC 27001Information Security Management Systems
- 03ISO/IEC 27005Information Security Risk Management
- 04ISO/IEC 27035Information Security Incident Management
- 05ISO/IEC 27040Storage Security
- 06ISA/IEC 62443Industrial Automation and Control Systems Security
- 07PECB CISOChief Information Security Officer
- 08EBIOSEBIOS Risk Manager
Important Information About ISO Standards, Professional Training & Certification
The catalogue is informational. The inclusion of a standard or course category does not guarantee the availability of a training session, examination, specific credential, or certification service through INCYB. Course delivery arrangements, fees, schedules, languages, prerequisites, examinations, and certification conditions must be confirmed for each offering.
ISO and IEC develop and publish international standards. They do not themselves issue the individual professional certifications described on this page.
PECB credentials are governed and issued by PECB under its applicable examination and certification rules. Reference to a PECB pathway does not, by itself, establish that INCYB is an authorized PECB partner, approved training provider, or representative.
Individual training, course completion, examination success, professional certification, organizational management-system certification, and laboratory accreditation are distinct processes and outcomes.
Professional learning and certification do not guarantee employment, promotion, salary increases, regulatory compliance, or organizational certification.
Make Your Next Professional Qualification Count.
Contact INCYB with your professional background, area of interest, preferred learning level, and intended qualification.
Explore ISO/IEC 27002 Controls Training