ISO/IEC 27002: The 93 Information Security Controls (Udemy.com)

ISO/IEC 27002 is the international standard that explains the 93 information security controls of ISO/IEC 27001 — what each control means, what it is for, and how it can be implemented. Where ISO/IEC 27001 lists the controls (in its Annex A), ISO/IEC 27002 is the implementation guidance: the reference every ISMS implementer, security officer and auditor works with daily.

This course details all 93 controls, organized by the four themes of the standard.

Course structure

• Introduction — the ISO/IEC 27000 family of standards, the position and purpose of ISO/IEC 27002, definitions of information security, cybersecurity and privacy, and what an information security management system (ISMS) consists of

• The 37 organizational controls — including information security roles and responsibilities, segregation of duties, threat intelligence, information security in project management, information classification and labelling, access control, information transfer, supplier relationships, ICT continuity, privacy and protection of PII, and documented operating procedures

• The 8 people controls — screening, terms and conditions of employment, security awareness and training, the disciplinary process, and remote working

• The 14 physical controls — secure areas, physical entry controls, clear desk and clear screen, storage media, supporting utilities, and the secure re-use and disposal of equipment

• The 34 technological controls — endpoint devices, data masking, information deletion, backup, cryptography, logging and monitoring, network security, secure development and secure coding, protection of test information, web filtering, secure authentication, access to source code, and privileged utility programs

• Certification — how ISO/IEC 27001 certification works for organizations, and the certification paths available to individuals working with ISO/IEC 27001 and 27002

How this course relates to ISO/IEC 27001

ISO/IEC 27001 sets the requirements for an ISMS and is the standard organizations certify against; ISO/IEC 27002 provides the detailed guidance for implementing its controls. If you are implementing an ISMS, preparing for certification, or selecting controls for your Statement of Applicability (SoA), this course gives you the control-by-control understanding that ISO/IEC 27001 itself does not provide.

Who this course is for

• ISMS implementers and information security officers selecting and implementing controls

• IT and cybersecurity professionals mapping their technical work to ISO/IEC 27001 requirements

• Internal auditors and consultants who need to understand what good control implementation looks like

• Anyone preparing their organization for ISO/IEC 27001 certification