Protecting against malware, data loss, and technical vulnerabilities.

A statement of what the organization should achieve.

Network security and information transfer.

Detailed instructions on the practical steps needed to satisfy the control.

is an international standard that serves as a detailed "code of practice" for organizations looking to establish, implement, or maintain an Information Security Management System (ISMS). While ISO/IEC 27001 defines the requirements for an ISMS, ISO/IEC 27002 provides the how-to —the specific implementation guidance for the controls listed in Annex A of ISO 27001. 1. Structural Overview

Securing physical areas and equipment.