Public revision guide

ISO 27002:2022: 93 controls, practice questions and examples

Study what each control is intended to achieve and when it may be relevant. Practice means distinguishing related measures, requesting evidence and justifying a choice in context, not merely memorizing numbers.

What to study and what the numbers mean

The 93 controls comprise 37 organizational, 8 people, 14 physical and 34 technological controls. A control is a topic, not a question. Preparation provides four variants per topic and study blocks without mixing in ISO 27001 requirement practice.

ISO 27001 vs ISO 27002

ISO 27001 sets requirements for an information security management system (ISMS). ISO 27002 explains information security controls and their application. Control selection must be justified against risks and applicable requirements, not by treating all 93 as mandatory. ISMS certification is assessed against ISO 27001, not by answering these questions.

How to prepare for practice

Work through the four groups: organizational (5), people (6), physical (7) and technological (8). For each control note its purpose, a relevant situation and possible evidence.
Compare related measures: identity management (5.16) is not the same as reviewing access rights (5.18); backups (8.13) alone do not cover all ICT readiness for business continuity (5.30).
Practise single-standard cases and review explanations. For broader assessment, choose a 20-, 40-, 60- or 100-question mock exam; several questions may concern one control without repeating a variant.

Sample question with an explained answer

Fictional situation and data created by Nexsora. Consult the complete text in an authorized copy of the standard.

A team records 20 completed backups but has never tested restoring them. Which control should you consult to verify that the copies can support recovery?

Reasoned answer

8.13, information backup. A process finishing without an error does not demonstrate recoverability. Backups and restoration should be checked against the organization’s needs and procedures.

What to verify

Review backup records, restoration results and comparison with approved recovery objectives. If 19 of 20 test copies restore successfully, 95% describes that sample; it is not a universal conformity threshold set by ISO 27002.

Common distinctions to get right

A control is not automatically mandatory because it appears in ISO 27002. Connect it to risks, obligations and the organization’s justified selection.
An installed tool or published policy alone does not demonstrate effective operation. Look for relevant configurations, records and results.

Go to ISO practice questions and mock exams

Select the standard in the practice area. Sign in to save attempts and try the free sample; full modes require current access or an administrator role.

ISO 27001:2022 revision guide, practice questions and mock exams

Official source and editorial scope

Official ISO/IEC 27002 information (external site; opens a new tab)

Study baseline: the 2022 editions, excluding the 2024 amendments. ISO 27001 defines ISMS requirements; ISO 27002 provides control guidance. Not every control is mandatory: selection must be justified by risks and applicable requirements. Material is available in Spanish, English, Brazilian Portuguese and French. Quechua and Aymara retain Spanish support. Translations and content await independent specialist editorial review; they are not official versions of the standards.

Original, independent Nexsora material. This is not an official exam, does not grant ISO certification and is not endorsed by ISO. Explanations do not replace an authorized copy of the standards.