Who uses it
Security teams use it when putting ISO/IEC 27001 controls in place. Auditors also use it to understand how a control is meant to work.
How it is applied
- Current practice is compared with the guidance.
- Management agrees which parts apply and who owns them.
- Practices are adopted in policies, procedures and training.
- Results are reviewed after a set period and adjusted.
Cost drivers
Cost is mainly staff time and any outside support. The number of processes and teams involved decides the effort. No certification fees apply, as no certificate is issued.
Timeline
Most organisations adopt it in phases over several months. It can run alongside work on a certifiable standard.
Certification
ISO/IEC 27002 is guidance, so accredited certificates are not issued against it. Certification is sought against ISO/IEC 27001, which it supports.
