BS EN ISO/IEC 27002:2022, the third edition of this standard, technically revises, cancels and replaces the second edition – BS EN ISO/IEC 27002:2017. The standard provides a reference set of information security controls for use in the context of BS EN ISO/IEC 27001 (the Information Security Management System, or ISMS requirements standard). It can also be used as a guidance document for organizations wishing to develop their own information security control guidelines. The document is intended for use by organizations of all types and sizes
BS EN ISO/IEC 27002 ultimately provides recommendations that helps businesses to strengthen their information security – vital in today's world where the number and sophistication of cyber-attacks is on the rise.
It has been developed to be used by any organization, of any size or sector, wanting to implement commonly accepted information security controls, such as threat intelligence and data leakage prevention.
It’s a supplementary document to BS EN ISO/IEC 27001 that helps users to identify and implement the information security controls that are most appropriate to their organization’s needs and which in turn can help strengthen the way in which information is protected.
Users of this information security controls standard will typically be anyone with an interest in information security and risk management within their business, where activities such as the creation, collection, processing, storing, transmitting, and disposing of information takes place.
If your business handles with sensitive employee or client data, you might also want to consider also implementing standard BS EN ISO/IEC 27701. This document serves as an extension to BS EN ISO/IEC 27001 and BS EN ISO/IEC 27002 and can help business manage its privacy risks with confidence.