Compliance tools · Cybersecurity and data protection

Toolkit for ISO 27002

ISO/IEC 27002:2022 · European Union and United Kingdom · Voluntary standard

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your Toolkit for ISO 27002 documentation cited clause by clause. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

Toolkit for ISO 27002 is ISO/IEC 27002:2022, a voluntary standard in the European Union and United Kingdom. Information security controls guidance supporting ISO 27001. The toolkit runs alongside your own licensed copy of the ISO standard.

The free assessment screens for Toolkit for ISO 27002 when a business handles personal data, or makes or supplies products or services with digital elements.

This is a voluntary standard rather than binding law. Businesses adopt it because customers, insurers or public buyers ask for it.

Screen your business against all 116 agent toolkits, free →

• Your exact position under Toolkit for ISO 27002: what is in place, what is missing, and what to do about each gap.
• Documentation with clause citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the standard requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that Toolkit for ISO 27002 applies to your business, free →

Does Toolkit for ISO 27002 apply to my business?

ISO/IEC 27002:2022 applies to any organisation that wishes to select and apply information security controls, and it is voluntary unless a contract, regulation or procurement requirement makes adoption a condition. Typical adopters include organisations seeking ISO/IEC 27001 certification and entities required by customers or supply chain partners to show an information security baseline.

Who does ISO 27002 apply to?

It applies to any organisation that wishes to select and apply information security controls, with no mandatory scope defined by legislation. Typical adopters include organisations seeking ISO/IEC 27001 certification, entities required by customers or supply chain partners to demonstrate a baseline, organisations subject to regulations referencing ISO 27002 controls, and entities responding to cyber insurance requirements.

Does Toolkit for ISO 27002 apply to a small business?

The instrument has no size threshold. The 2022 edition is designed with smaller organisations in mind, and the reduction from 114 controls in the 2013 edition to 93 controls, plus the reorganisation from 14 domains into four themes, reduces the complexity of control selection.

When does ISO 27002 apply from, and what are the deadlines?

ISO/IEC 27002:2022 was published on 15 February 2022, replacing ISO/IEC 27002:2013. ISO/IEC 27001:2022 was published on 25 October 2022, and organisations certified to ISO 27001:2013 must complete transition by 31 October 2025 under IAF MD 26:2023, after which those certificates are no longer valid.

What does ISO 27002 require me to do?

The standard requires nothing by itself because all 93 controls are guidance and the organisation decides which controls to apply based on its risk assessment. Where adopted, Clause 5.1 requires top management to define, approve, publish and communicate an information security policy, and Clause 5.2 requires all information security roles and responsibilities to be defined and allocated.

What records or documents does ISO 27002 require me to keep or produce?

The Statement of Applicability documents the inclusion or exclusion of each control with justification, and Clause 5.2 requires a documented responsibility matrix with clear assignment within job descriptions. The certification process also reviews the information security policy, risk assessment methodology, risk treatment plan, Statement of Applicability and supporting procedures.

What happens if I do not comply with ISO 27002?

ISO/IEC 27002:2022 carries no direct legal penalties or fines, and no government or regulatory body can impose fines for non-compliance with the standard itself. Consequences arise indirectly, including loss of ISO 27001 certification, contractual breach, weakened defence under other instruments, insurance implications and procurement exclusion.

Does Toolkit for ISO 27002 apply to a UK business selling into the EU?

The standard is international and carries no geographic restriction, and the British Standards Institution publishes the UK national adoption as BS EN ISO/IEC 27002:2022. The instrument does not state a rule addressed specifically to a UK business selling into the EU.

Does Toolkit for ISO 27002 apply to an EU business selling into the UK?

The standard is international and carries no geographic restriction, and equivalent national adoptions exist in Germany (DIN), France (AFNOR) and the United States (ANSI). The instrument does not state a rule addressed specifically to an EU business selling into the UK.

How is ISO 27002 different from ISO 27017?

ISO/IEC 27017:2015 provides cloud-specific security guidance supplementing ISO 27002, and the 2022 edition's new Clause 5.23 (information security for cloud services) partially supersedes ISO 27017 by bringing cloud security into the main control set.

How do I start complying with ISO 27002?

The first practical step is to select controls through a risk assessment, because the organisation decides which controls to apply based on its risk assessment and the Statement of Applicability documents the inclusion or exclusion of each control with justification. Risk assessment under ISO 27005 determines which ISO 27002 controls the organisation selects.

Which ComplianceSME account includes the Toolkit for ISO 27002 toolkit?

The Toolkit for ISO 27002 agent toolkit is included in Compliance Complete.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive