You’ve heard of ISO 27001 the management system. But what about the controls that actually protect your data day to day? That’s ISO 27002 Canada. Think of it as the toolbox. While ISO 27001 tells you that you need to manage risks, ISO 27002 tells you how to pick and implement specific security measures. At A & T Global IT Consulting, we help Canadian businesses stop guessing and start using these controls like pros. Let’s break down the 2013 version (still widely used), the individual controls, and how this standard differs from its famous cousin.
ISO 27002 2013
You might see “ISO 27002:2022” floating around, but many Canadian companies are still running on the ISO 27002 2013 edition. Why? Because it’s stable, well‑understood, and certifying bodies accept it alongside ISO 27001:2013. The 2022 update changed the control structure, but the 2013 version remains rock solid for most SMEs.
What’s Inside the 2013 Edition?
The 2013 standard lists 114 controls across 14 clauses. Each control comes with a clear “implementation guidance” paragraph. No vague statements just practical steps. For example, control A.9.2.1 (user registration) tells you exactly how to onboard and offboard employees. You get a checklist, not a philosophy. Common mistake: people treat ISO 27002 as optional reading. Wrong. Your ISO 27001 audit will ask for evidence that you followed these implementation guides. We’ve seen auditors flag missing password expiration rules because a company ignored the guidance in A.9.4.3.
Transitioning to the 2022 Update
If you’re starting fresh, we usually recommend the 2022 version. It reduces controls to 93 and adds new themes like “threat intelligence” and “cloud security.” But don’t panic if you’re in 2013. You can migrate later with a simple gap assessment. We’ve done this for dozens of Canadian firms in under two weeks.
ISO 27002 Controls
Here’s the heart of the standard. ISO 27002 controls are your action items. Each one answers a specific security problem. You don’t have to use all of them, just the ones that fit your risks. But you need to know what they are so you can make smart choices.
ISO 27002 Annex A (2013)
The ISO 27002 annex A is where the magic happens. It groups controls into 14 categories, from security policies to supplier relationships. Let’s walk through the ones that trip up most Canadian businesses:
- A.6 – Organization of information security: Who does what? You need a clear security role (even if it’s part‑time). Real example: a Toronto marketing agency got dinged because no one owned “patch management.” We fixed that in the afternoon.
- A.9 – Access control: This is where you mess up most often. Shared passwords, ex‑employees still in the system, admins with too much power. The control says: review access rights every three months. Set a calendar reminder today.
- A.12 – Operations security: Malware protection, backup, logging. Sounds basic, but we regularly find companies with no backup test log. The auditor will ask for it. Have it ready.
- A.16 – Incident management: Who do you call when a laptop gets stolen? Write down the steps now. Don’t wait for a breach.
Security ISO Standards – How 27002 Fits
Security ISO standards form a family. ISO 27001 is the management system. ISO 27002 is the implementation guide. ISO 27003 is the roadmap (planning), 27004 is about measurement (metrics), and 27005 is risk management. You don’t need all of them. Most Canadian companies only need 27001 and 27002. Think of 27002 as the “how‑to” manual that lives on your desk. When your team asks “What exactly should we do for access control?” you hand them ISO 27002.
ISO 27001 vs 27002
This confuses almost everyone. Let’s settle it. ISO 27001 vs 27002 isn’t a competition, they’re partners. One is the rulebook, the other is the playbook. Here’s the plain‑English breakdown.
The Simple Difference
- ISO 27001: The “what.” It sets requirements for your Information Security Management System (ISMS). You get certified against this standard. It has 11 clauses (4‑10) plus Annex A (control objectives).
- ISO 27002: The “how.” It provides detailed implementation guidance for each control in Annex A. You cannot get certified against ISO 27002. It’s a supporting document.
Example: ISO 27001 says “you must control access to your network.” ISO 27002 says “here’s how to set up user IDs, password policies, and session timeouts.” See the difference? You need both to succeed.
Why You Need Both for ISO 27002 Canada
If you’re pursuing ISO 27001 certification in Canada, you absolutely need ISO 27002. Why? Because auditors expect you to follow the guidance. We’ve sat in audits where the lead auditor opened ISO 27002 and asked “Show me where you’ve implemented the steps in control A.9.2.5 (review of user access rights).” If you’ve never read ISO 27002, you’ll stumble. Our recommendation: buy the two‑ packs (27001 + 27002) from the ISO store. Keep them on every security manager’s desk.
Why A & T Global IT Consulting Stands Out for ISO 27002 Canada
You can read the standards yourself. But turning 114 controls into daily habits? That’s where we shine. Here’s what you get when you work with us:
- Plain‑language workshops – We don’t read the standard to you. We walk through each control group and say “here’s what this means for your specific industry.” Healthcare? Finance? Manufacturing? Different controls matter.
- Control‑to‑evidence maps – We hand you a spreadsheet that lists every ISO 27002 control and exactly what document or log proves you did it. No hunting around the night before an audit.
- Canadian context – PIPEDA privacy rules, provincial breach notification laws, and even Quebec’s Law 25. We map ISO 27002 controls to your legal obligations so you cover both.
- Fixed‑fee gap assessments – We’ll review your current security practices against ISO 27002 controls and give you a prioritized fix‑it list. No hourly billing, no surprise charges.
- Post‑certification support – Got a new cloud tool? Hiring remote staff? We’ll help you update your controls without re‑learning the whole standard.
Biggest mistake we correct: people implement controls but never test them. You have a backup policy? Great. When did you last restore a file from that backup? We build simple quarterly tests into your calendar.
Frequently Asked Questions
What is the ISO 27002 certification?
There’s no such thing as an “ISO 27002 certification.” You certify to ISO 27001, not 27002. ISO 27002 is a supplementary guidance document that tells you how to implement the controls listed in ISO 27001’s Annex A. Think of it as the instruction manual, not the test.
Why is ISO 27002 certification important?
Since you can’t certify to it, the importance is different: ISO 27002 is your cheat sheet for passing the real audit. Auditors check your controls against the implementation guidance in ISO 27002. If you ignore it, you’ll miss details like “review access rights every three months” or “maintain an inventory of approved software.” Following ISO 27002 slashes your audit findings.
Who needs ISO 27002?
Anyone building an Information Security Management System (ISMS) for ISO 27001 certification needs a copy of ISO 27002. That includes security managers, compliance officers, IT directors, and external consultants. If you’re responsible for writing policies, setting up access controls, or managing incidents, you need this standard on your shelf.
Can I use ISO 27002 without ISO 27001?
Yes. Many Canadian companies adopt ISO 27002 controls as a security baseline even if they never pursue certification. It’s a fantastic, ready‑made checklist of best practices. For example, a Vancouver startup used our ISO 27002 control map to satisfy a major client’s security questionnaire without going through the full certification.
Is ISO 27002:2022 mandatory in Canada?
No. You can still use the 2013 version if your ISO 27001 certificate is based on the 2013 edition. However, new certifications after October 2025 will likely require the 2022 update. We recommend planning your transition within the next 12–18 months. We offer a straightforward “2013 to 2022 gap analysis” for a $1,500 fixed fee.
How many controls are in ISO 27002:2022?
The 2022 version has 93 controls, down from 114 in 2013. They’re reorganized into four themes: Organizational (37 controls), People (8 controls), Physical (14 controls), and Technological (34 controls). Many controls were merged or removed. We can show you a crosswalk between the old and new numbers.
Where can I learn ISO 27002 properly?
Start with our PECB ISO/IEC 27001 training courses. We teach ISO 27002 controls as part of the Lead Implementer program. You’ll get hands-on exercises, real audit scenarios, and a copy of the standard. No boring lectures.
