Every organisation relies on information – most depend on it. Information is an asset, just like other essential business assets, and must be protected accordingly. Information security is no longer just a technical issue; it is a vital business concern. While compliance with legal and regulatory requirements is crucial and provides a strong incentive to review your information security practices, it should not be the sole or even the primary driver. For a business to succeed, it must recognise the importance of information security and implement appropriate measures and processes.

Understanding ISO 27002 Information Security

ISO/IEC 27002 establishes guidelines and principles for initiating, implementing, maintaining, and improving information security management within an organisation. This standard is explicitly concerned with the security of all forms of information—including computer data, documentation, knowledge, and intellectual property—not just IT systems or cybersecurity.

ISO/IEC 27002 is a code of practice, offering recommended information security controls that address control objectives related to the confidentiality, integrity, and availability of information. It is not a formal specification like ISO/IEC 27001, but the two standards are designed to be used together, complementing each other to provide a comprehensive framework for information security management.

By understanding and applying the principles of ISO/IEC 27002 alongside ISO/IEC 27001, organisations can better protect their information assets, ensure compliance with regulations, and ultimately, safeguard their business from potential security breaches.