ISO 27002 compliance: what it means for your data and your outsourcing partners

What is ISO 27002 compliance?

ISO 27002 compliance means aligning your information security practices with ISO/IEC 27002, the international code of practice that explains how to select and run security controls.

In short, it covers the practical “how” behind security. Here is what that means for a buyer:

• The standard is guidance, not a certificate, so no one gets “certified to ISO 27002.”
• It spells out how to apply the controls that a certifiable framework like ISO 27001 requires.
• A provider that cites it is telling you its controls rest on a documented, global playbook.

For any business weighing whether to hand over customer records, payment data, or patient files, that distinction matters. So let us look at what the standard actually covers, why it matters when you outsource, and how to ask for proof.

What ISO 27002 compliance actually covers

ISO 27002 is a register of controls that supports ISO 27001. The 2022 version reorganized everything into four clear themes. In total, the current edition defines 93 controls grouped under organizational, people, physical, and technological categories.

The published standard from ISO describes each control’s purpose and how to apply it. For example, it spans access management, cryptography, supplier relationships, and incident handling. The four themes replaced the older 14-domain, 114-control structure. As a result, the framework is easier to map against modern setups like cloud services and remote teams.

The 2022 edition also added 11 new controls. These cover areas such as threat intelligence, cloud security, data masking, and secure coding. In other words, they reflect how attack surfaces have shifted over the past decade. Each control now carries attributes, such as control type and security property. So a security team can filter the catalog and pull, for instance, every preventive control tied to identity. For a buyer, the value is traceability: a provider can show which controls apply to your work and why. It also lines up neatly with the broader cybersecurity frameworks many firms already run.

Organizational and people controls

These controls govern policy, accountability, and human behavior. That is where most breaches start.

Organizational controls cover policies, roles, supplier security, and threat intelligence. People controls address screening, training, and the duties staff carry after a job ends. For an outsourcing deal, this layer decides whether agents handling your data are vetted and trained the same way every time. A call center processing payment details, for example, should show background checks, a signed acceptable-use policy, and regular phishing training. One onboarding session is not enough.

Physical and technological controls

These controls protect the places and systems where data lives.

Physical controls include secure areas, clear-desk rules, and safe equipment disposal. Technological controls span encryption, logging, network security, and secure development. Together, they form the part of ISO 27002 that clients most often ask to see during vendor checks. In a delivery center, that might look like badge-controlled floors, locked-down USB ports, encrypted disks, and logging that flags an agent pulling more records than their role needs.

Why ISO 27002 compliance matters when you outsource

Outsourcing moves sensitive data outside your walls. So the control standard your provider follows becomes your control standard by extension.

The financial stakes are concrete. The global average cost of a data breach reached USD 4.88 million in 2024, up from USD 4.45 million the year before. A provider that runs documented ISO 27002 controls lowers the odds that your data joins that statistic. In addition, it gives you a clear answer when regulators or clients ask how you vetted the relationship.

Regulators increasingly expect that diligence in writing. If a breach traces back to a vendor, “we trusted them” is not a defense. Instead, showing that you required a recognized standard, and built it into the contract, shifts a finding from negligence to reasonable care. This is also where legal compliance in outsourcing and the wider demands of global compliance in outsourcing come into play.

There is also a contractual angle. Strong agreements name the security standard the provider must keep, the breach-notification window, and audit rights. Because ISO 27002 gives both sides a shared vocabulary, a phrase like “supplier security controls” maps to a specific, agreed set of practices. So it is not left open to interpretation. You can read more on locking down vendor relationships in our guide to data security in outsourcing.

ISO 27002 compliance vs. ISO 27001 certification

The two standards are siblings, and mixing them up wastes procurement effort. So here is how they line up against the questions buyers usually ask.

The takeaway is simple. Ask a prospective provider for its ISO 27001 certificate if you need third-party assurance. Then ask how it applies ISO 27002 controls if you want the substance behind that certificate. Also check the certificate’s scope statement. After all, a firm can be certified for one site while the team serving you sits outside that boundary. A firm that can speak to both is usually further along than one that waves a logo without detail. Buyers who want a second reference point can compare it against SOC 2 compliance.

How providers demonstrate ISO 27002 compliance

Credible providers back claims with artifacts, not adjectives. Common evidence includes a documented Statement of Applicability, access-control logs, encryption policies, training records, and audit results.

The Statement of Applicability is the document worth reading first. It lists each control, whether the provider applies it, and the reason for any exclusion. Firms that run their own facilities often pair this with physical safeguards. For more on that, see our overview of managed data centers. Still, ask to see how controls are reviewed over time. A one-off assessment tells you little about day-to-day discipline. For ongoing cover, many buyers add outsourced cybersecurity services on top of the provider’s own program. Individuals weighing their own exposure can also review practical steps in our digital privacy guide.

Frequently asked questions about ISO 27002 compliance

Buyers and providers tend to raise the same handful of questions when this standard comes up.

Can a company be certified to ISO 27002?

No. ISO 27002 is a guidance standard, so firms cannot be certified against it. Certification applies to ISO 27001 instead. ISO 27002 supports that effort by detailing how to apply the underlying controls.

How many controls does ISO 27002 contain?

The 2022 edition defines 93 controls across four themes: organizational, people, physical, and technological. For comparison, this replaced the earlier structure of 114 controls spread across 14 domains.

Does ISO 27002 compliance satisfy GDPR or HIPAA?

Not on its own. ISO 27002 strengthens the security practices that rules like GDPR and HIPAA expect. However, each regulation carries its own legal duties that you must address separately.

Should I require ISO 27002 from an outsourcing provider?

Reference it in vendor due diligence and contracts as the control baseline. Then ask for the provider’s ISO 27001 certificate as formal proof. Together, the two give you both substance and assurance.

How often should ISO 27002 controls be reviewed?

Treat it as ongoing, not a one-time task. Most mature programs review controls at least once a year, plus after any major change or incident. So ask a provider how often it tests and updates its controls.