Who this is for
Organizations that want ISO-aligned security practice without (or before) certification, teams answering customer questionnaires that reference ISO/IEC 27002, and ISO/IEC 27001 programs that need their controls implemented to a defensible standard rather than documented to a minimum. It is also a practical lens for measuring a NIST SP 800-171 program: the same controls, described from a different angle.
What we deliver
Control maturity assessment
Each of the 93 controls assessed for design and operating effectiveness against the 27002 guidance, with a maturity score and the evidence behind it.
Attribute-based views
Controls tagged with the 2022 attributes (control type, security properties, cybersecurity concepts, operational capabilities, security domains) so you can report by Identify through Recover or by capability.
Control-owner playbooks
Short, practical playbooks per control owner: what the control expects, how it is done in your environment, and what evidence proves it.
The 2022 additions
Focused implementation of the controls added in 2022, including threat intelligence, cloud service security, ICT readiness for business continuity, configuration management, data leakage prevention, monitoring, web filtering, and secure coding.
NIST SP 800-171 crosswalk
A control-level crosswalk between 27002 guidance and your 800-171 requirements, so one implementation answers both, and questionnaires reuse the same evidence.
Questionnaire support
Answers to customer security questionnaires that reference ISO/IEC 27002 controls, drawn from the assessed evidence rather than written from memory.
ISO/IEC 27002 attributes, in practice
| Attribute type | Values | What it lets you do |
|---|---|---|
| Control type | Preventive, detective, corrective | Check you are not only preventing, but detecting and correcting |
| Information security properties | Confidentiality, integrity, availability | Report protection by property; CUI is mostly confidentiality |
| Cybersecurity concepts | Identify, protect, detect, respond, recover | Speak the same language as the NIST Cybersecurity Framework |
| Operational capabilities | e.g., identity and access management, asset management | Assign controls to the teams that run them |
| Security domains | Governance and ecosystem, protection, defence, resilience | Summarize posture for leadership |
27001 or 27002? You certify to ISO/IEC 27001. You implement with ISO/IEC 27002. Organizations not ready to certify still get the benefit of ISO-grade controls, and the work carries straight into a certification later.
How an engagement runs
- Assess (3–4 weeks): maturity assessment of all 93 controls with evidence, tagged by attribute.
- Prioritize (1 week): a roadmap ranked by risk and by what your customers and contracts ask for.
- Implement (ongoing): control-owner playbooks and focused work on the weakest controls, starting with the 2022 additions.
- Measure: annual re-assessment and questionnaire support as part of Managed Compliance.
Questions contractors ask us
Can we be certified to ISO/IEC 27002?
No. ISO/IEC 27002 is a guidance standard, so organizations are not certified against it. Certification is to ISO/IEC 27001, whose Annex A lists the same 93 controls that 27002 explains.
What changed in the 2022 edition?
The controls were consolidated from 114 into 93 and regrouped into four themes: organizational, people, physical, and technological. Eleven controls are new, and each control now carries attributes that allow filtering by control type, security property, cybersecurity concept, operational capability, and security domain.
How does 27002 relate to NIST SP 800-171?
They overlap heavily in substance. NIST SP 800-171 defines requirements for protecting CUI; ISO/IEC 27002 gives implementation guidance for a broad control set. A crosswalk lets one implementation serve both, which is what we build.
Is a maturity assessment useful if we already passed CMMC?
Yes. CMMC tests whether requirements are met. A 27002 maturity assessment shows how well controls operate and where they are brittle, which is what keeps you passing between assessments.
See how well your controls actually operate.
Tell us what you run today and who is asking about ISO/IEC 27002, and we'll scope the maturity assessment. Or email rj@indirectit.com directly.