Protection of Information Assets

Confidentiality (only authorized disclosure), integrity (accuracy and completeness, no unauthorized change), and availability (accessible when needed).

Requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS); organizations can be certified against it.

ISO/IEC 27002 gives guidance on implementing the controls listed in 27001's Annex A; it is not itself certifiable.

93 controls grouped as organizational, people, physical and technological.

A document listing each Annex A control, whether it is applied or excluded, and the justification, linking controls to the risk treatment plan.

Govern, Identify, Protect, Detect, Respond and Recover.