ISO IEC 27002 Information security, cybersecurity and privacy protection — Information security controls

This document is designed for organizations of all types and sizes. It is to be used as a reference for
determining and implementing controls for information security risk treatment in an information
security management system (ISMS) based on ISO/IEC 27001. It can also be used as a guidance
document for organizations determining and implementing commonly accepted information security
controls. Furthermore, this document is intended for use in developing industry and organization specific
information security management guidelines, taking into consideration their specific
information security risk environment(s). Organizational or environment-specific controls other than
those included in this document can be determined through risk assessment as necessary.
(Document is valid with variation of document cover only. ISO updated the cover format as of 2024 with the climate change update.)