ISO/IEC 27002 is a code of practice - a generic, advisory document which recommends information security controls addressing information security control objectives arising from risks to the confidentiality, integrity and availability of information.
An information security standard published by the International Organization for Standardization (ISO) and by the International Electrotechnical Commission (IEC), titled Information technology – Security techniques – Code of practice for information security controls.
It is an advisory standard that is meant to be interpreted and applied to all types and sizes of organization according to the particular information security risks they face.
source Wikipedia:
