ISO/IEC 27002:2013

Why does it matter?

ISO/IEC 27002:2013 matters today mainly as the key to older documents. Control numbers such as 5.1.1 (policies for information security) and clause names such as 12.4 (logging and monitoring) appear in risk registers, policies, supplier questionnaires and audit reports written before 2022, and reading them correctly means knowing this edition's structure.

Key benefits include:

• Legacy references still resolve

Policies and Statements of Applicability written against the 2013 controls cite clause numbers from 5 to 18, so the edition is needed to interpret them.

• A fixed three-level structure

14 clauses contain 35 main security categories and 114 controls, which makes gaps visible clause by clause (Clause 4.1).

• Objectives before controls

Every main security category opens with a control objective stating what is to be achieved, then lists the controls that can achieve it (Clause 4.2).

• Guidance with each control

Controls are followed by implementation guidance and other information, such as legal considerations and references to other standards (Clause 4.2).

• A defined path to the 2022 set

ISO/IEC 27002:2022 Annex B shows the correspondence between its controls and this edition, including merged, deleted and new controls.

How does it work?

The 14 clauses are: information security policies (5), organization of information security (6), human resource security (7), asset management (8), access control (9), cryptography (10), physical and environmental security (11), operations security (12), communications security (13), system acquisition, development and maintenance (14), supplier relationships (15), information security incident management (16), information security aspects of business continuity management (17) and compliance (18).

Within each category, the control objective comes first and the controls follow. A control is written as the control itself, implementation guidance, which the standard says is not necessarily fully suitable or sufficient in every situation, and other information. The order of the clauses does not reflect importance, and the lists in the standard are not in priority order (Clause 4.1).

Selecting controls is the organization's decision. The Introduction says controls can be selected from this standard or other sets, or designed to meet specific needs, and that selection depends on risk acceptance criteria, risk treatment options, the overall risk management approach and relevant legislation (0.3). Risk assessment is one of three sources of security requirements, alongside legal, regulatory and contractual requirements and the organization's own principles and business requirements (0.2); ISO/IEC 27005 gives guidance on managing information security risks.

Key Elements

• Policies and organization (Clauses 5 and 6)

Management direction for information security (5.1); internal organization, and mobile devices and teleworking (6.1 and 6.2).

• People and assets (Clauses 7 and 8)

Prior to, during and at termination or change of employment (7.1 to 7.3); responsibility for assets, information classification and media handling (8.1 to 8.3).

• Access control and cryptography (Clauses 9 and 10)

Business requirements, user access management, user responsibilities and system and application access control (9.1 to 9.4); cryptographic controls (10.1).

• Physical and environmental security (Clause 11)

Secure areas (11.1) and equipment (11.2).

• Operations security (Clause 12)

Operational procedures, protection from malware, backup, logging and monitoring, control of operational software, technical vulnerability management and information systems audit considerations (12.1 to 12.7).

• Communications and system acquisition (Clauses 13 and 14)

Network security management and information transfer (13.1 and 13.2); security requirements of information systems, security in development and support processes and test data (14.1 to 14.3).

• Suppliers and incidents (Clauses 15 and 16)

Information security in supplier relationships and supplier service delivery management (15.1 and 15.2); management of information security incidents and improvements (16.1).

• Continuity and compliance (Clauses 17 and 18)

Information security continuity and redundancies (17.1 and 17.2); compliance with legal and contractual requirements and information security reviews (18.1 and 18.2).

What does it cover?

Clause 1 says the standard gives guidelines for organizational information security standards and information security management practices, including the selection, implementation and management of controls, taking the organization's information security risk environment into account. It was designed for organizations that intend to select controls within the process of implementing an ISMS based on ISO/IEC 27001, implement commonly accepted information security controls, or develop their own information security management guidelines. Its only normative reference is ISO/IEC 27000, which supplies the terms and definitions (Clauses 2 and 3).

What are its objectives?

The Introduction sets out what the standard is for:

To be a reference for selecting controls in an ISMS based on ISO/IEC 27001 (0.1).

To guide organizations that implement commonly accepted information security controls (0.1).

To help organizations meet requirements from risk assessment, legal and contractual obligations, and their own business requirements for handling information (0.2).

To balance the resources used for controls against the business harm that could follow without them (0.2).

To serve as a starting point for organization-specific guidelines, with cross-references to its clauses kept for auditors and business partners (0.4).

To keep information security in view at every stage of the life cycle of information and systems (0.5).

Framework in Context

ISO/IEC 27002:2013 is the second edition; it replaced the 2005 edition and was itself withdrawn on February 15, 2022, when ISO/IEC 27002:2022 replaced it with 93 controls in four themes and five attributes in place of 14 clauses and 114 controls. ISO/IEC 27017:2015, the cloud code of practice, followed this edition's clause numbers 5 to 18 and has in turn been replaced by an edition based on ISO/IEC 27002:2022. ISO/IEC 27001:2013 certifications that relied on these controls could be transitioned until October 31, 2025 under IAF MD 26:2023.

Common Framework Mappings

The 2013 controls are commonly mapped to the frameworks below, and to ISO/IEC 27002:2022 through its Annex B, so older evidence can still serve current programs.

Mapped frameworks include:

CIS Controls v8.1

ISO 27001:2022

ISO/IEC 27003

ISO 27017

ISO 27018

ISO 27701

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2