ISO 27001 LI · Domain 2 of 7

ISO 27001 LI Domain 2: Information Security Management System Requirements

Despite its title, this domain is about controls: security services, architecture frameworks, the 93 Annex A controls and ISO/IEC 27002 guidance, the four control themes, and selecting, implementing and documenting controls.

Exam weight
15%
Official knowledge statements
6
Estimated questions estimate
~12
Suggested study time estimate
9–12 hrs

About 13 min read Reviewed October 2026

Overview

Domain 2 carries the PECB title Information Security Management System Requirements, but its six knowledge statements focus on the control side of the standard. They cover common security services, the best-known security architecture frameworks, the 93 controls in Annex A of ISO/IEC 27001:2022 with their ISO/IEC 27002 guidance, the four control themes, how controls are selected and implemented, and how the chosen controls are documented.

The domain accounts for 12 of the 80 questions. Annex A lists control objectives in a single sentence each, while ISO/IEC 27002:2022 adds purpose, guidance and attributes. Because the exam is open book, a printed Annex A is a strong aid here, but only if you already know which theme a control sits in and roughly what it requires.

How it's tested

Expect a mix of recall and judgement. Some items ask which Annex A control or theme addresses a need. Others give a described risk and ask which control is most appropriate, or what must be recorded about a selected control. Distractors often name a real control from the wrong theme or a 2013 control number.

  • Which control fits

    A described risk, such as staff copying client data to personal cloud storage, must be matched to the most relevant Annex A control.

  • Which theme

    A control is named and you choose organizational, people, physical or technological, using the 2022 grouping rather than the old clause structure.

  • Service or framework

    A security need is described and you pick the security service or architecture framework that best addresses it.

Reasoning it through

A software firm suffers repeated injection flaws in released code. The question asks which Annex A control most directly addresses the cause. Options are 8.28 secure coding, 8.8 management of technical vulnerabilities and 5.24 incident management planning. Vulnerability management finds flaws after release and incident planning handles consequences, while secure coding prevents the flaw at source. Choose 8.28, a technological control new in the 2022 edition.

Knowledge statements 6

Official knowledge statements from the PECB outline, in outline order.

2.1 Common security services such as access control services, boundary control services, integrity services, cryptographic services, and audit and monitoring servicesReusable security functions an architecture provides.
What it means
Security services are capabilities that many systems share. Access control services handle identification, authentication and authorization. Boundary control services filter traffic between zones, as firewalls and gateways do. Integrity services detect unauthorized change. Cryptographic services provide encryption, signing and key management. Audit and monitoring services record and analyse events.
What to understand
Thinking in services helps an implementer design consistent protection rather than buying point products. Each service maps to Annex A controls, for example access control services to 5.15 to 5.18 and 8.5, cryptographic services to 8.24, and monitoring to 8.15 and 8.16. A weakness in one shared service affects every system that relies on it.
How it shows up
Expect a described need, such as proving a file was not altered, and a choice among services.
Common confusion
Treating encryption as an integrity service when the need is confidentiality, or the reverse.
2.2 The most common architecture frameworksStructured methods for designing enterprise and security architecture.
What it means
Architecture frameworks give a structured way to describe and design how business, information and technology fit together. Common examples are TOGAF for enterprise architecture, the Zachman Framework as a classification schema, and SABSA for business-driven security architecture.
What to understand
SABSA starts from business requirements and traces them to security services and mechanisms, which suits risk-based ISMS work. TOGAF's Architecture Development Method is iterative and can embed security. Zachman organizes views by questions such as what, how, where, who, when and why. ISO/IEC 27001 does not require any framework.
How it shows up
Questions ask which framework is designed specifically for security architecture driven by business requirements.
Common confusion
Believing ISO/IEC 27001 mandates a particular architecture framework.
2.3 The 93 Annex A controls of ISO/IEC 27001 and their guidance specified in ISO/IEC 27002The reference control set and its companion guidance.
What it means
Annex A of ISO/IEC 27001:2022 lists 93 controls, each in one sentence. ISO/IEC 27002:2022 expands each with a purpose, implementation guidance, other information and attribute values such as control type, security properties, cybersecurity concepts, operational capabilities and security domains.
What to understand
Annex A is a reference list used in clause 6.1.3 to check that no necessary control has been omitted. Organizations may also design their own controls or use other sets. ISO/IEC 27002 is guidance and cannot be certified against. Eleven controls are new in 2022, including 5.7, 5.23, 5.30, 7.4, 8.9, 8.10, 8.11, 8.12, 8.16, 8.23 and 8.28.
How it shows up
Expect items asking what ISO/IEC 27002 provides that Annex A does not, or which control is new.
Common confusion
Thinking an organization can be certified to ISO/IEC 27002.
2.4 The four groups of Annex A controls such as organizational controls, people controls, physical controls, technological controlsThe 2022 thematic grouping of controls.
What it means
Controls are grouped into four themes: organizational controls 5.1 to 5.37, people controls 6.1 to 6.8, physical controls 7.1 to 7.14 and technological controls 8.1 to 8.34. The theme reflects what the control mainly concerns.
What to understand
Organizational controls include policies, roles, asset management, supplier relationships, incident management, continuity and compliance. People controls cover screening, terms of employment, awareness, discipline, remote working and event reporting. Physical controls cover perimeters, entry, equipment and media. Technological controls cover endpoints, access, malware, backup, logging, networks, cryptography and development.
How it shows up
Questions name a control, such as remote working or information security event reporting, and ask its theme.
Common confusion
Placing remote working under technological controls when it is people control 6.7.
2.5 The selection and implementation of ISO/IEC 27001 Annex A controlsChoosing controls through risk treatment and putting them in place.
What it means
Controls are determined in clause 6.1.3 as part of risk treatment: the organization chooses treatment options, determines the controls needed, compares them with Annex A to confirm nothing necessary is missing, and produces the Statement of Applicability and the risk treatment plan.
What to understand
Selection considers risk level, legal and contractual requirements, cost, feasibility and existing controls. Implementation needs owners, resources, timelines, procedures, training and a way to measure effectiveness. Clause 8.1 requires operational planning and control, and outsourced processes must still be controlled.
How it shows up
Scenarios ask which consideration should drive control selection, with risk treatment decisions as the expected answer.
Common confusion
Selecting controls first and building the risk assessment around them afterwards.
2.6 The documentation of the selected information security controlsRecording controls so they can be operated and verified.
What it means
Selected controls are documented in the Statement of Applicability and supported by policies, procedures, configuration standards and records as needed. Documentation shows what the control is, who owns it, how it operates and what evidence it produces.
What to understand
Clause 7.5.1 requires documented information required by the standard and that the organization determines necessary for ISMS effectiveness, so the extent varies with size, complexity and competence. Some Annex A controls explicitly need documented procedures, such as 5.37 documented operating procedures. Records give evidence that controls operate.
How it shows up
Expect questions on how much documentation a control needs, where the answer depends on the organization's determination.
Common confusion
Assuming every control needs its own separate written procedure.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Annex A

    Normative list of 93 information security controls in ISO/IEC 27001:2022.

    Remember
    Used to verify no necessary control is omitted.
    Tested as
    Control selection and SoA items.
    Trap
    Treating it as a mandatory checklist.

  • ISO/IEC 27002:2022

    Guidance on implementing the controls, with purpose and attributes.

    Remember
    Guidance only; not certifiable.
    Tested as
    What-does-27002-add items.
    Trap
    Citing it as a source of requirements.

  • Organizational controls

    Theme 5, 37 controls.

    Remember
    Policies, roles, suppliers, incidents, continuity, compliance.
    Tested as
    Theme classification.
    Trap
    Putting supplier controls in technological.

  • People controls

    Theme 6, 8 controls.

    Remember
    Screening, terms, awareness, discipline, remote working, event reporting.
    Tested as
    Theme classification.
    Trap
    Missing that event reporting 6.8 is a people control.

  • Physical controls

    Theme 7, 14 controls.

    Remember
    Includes 7.4 physical security monitoring, new in 2022.
    Tested as
    Theme and new-control items.
    Trap
    Placing clear desk under organizational.

  • Technological controls

    Theme 8, 34 controls.

    Remember
    Largest set of new controls such as 8.12 data leakage prevention.
    Tested as
    Theme and selection items.
    Trap
    Forgetting secure coding 8.28 is here.

  • Control attributes

    Tags in ISO/IEC 27002 for filtering controls.

    Remember
    Control type, security properties, cybersecurity concepts, operational capabilities, security domains.
    Tested as
    27002 structure questions.
    Trap
    Thinking attributes are mandatory.

  • SABSA

    Business-driven security architecture framework.

    Remember
    Traces business requirements to security services.
    Tested as
    Framework selection items.
    Trap
    Confusing it with TOGAF.

  • Boundary control service

    Controls traffic between security zones.

    Remember
    Firewalls, gateways, network segregation.
    Tested as
    Security service questions.
    Trap
    Labelling it an access control service.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Annex A vs. ISO/IEC 27002

ConceptMeaningKey differenceCommon trap
Annex A of ISO/IEC 27001 One-sentence control statements, 93 in total Part of the certifiable standard Expecting implementation detail there
ISO/IEC 27002:2022 Purpose, guidance and attributes for each control Guidance; no certification Quoting it as a 'shall' requirement

Architecture frameworks

ConceptMeaningKey differenceCommon trap
SABSA Security architecture driven by business attributes Security-specific Seen as a general IT framework
TOGAF Enterprise architecture with an iterative development method General enterprise focus Assumed to be security-only
Zachman Matrix classifying architecture views by perspective and question Taxonomy rather than method Treated as a step-by-step process

2013 vs. 2022 Annex A structure

ConceptMeaningKey differenceCommon trap
2013 edition 114 controls in 14 clauses A.5 to A.18 Clause-based layout Using old numbers in answers
2022 edition 93 controls in 4 themes, 11 new Theme-based with attributes in 27002 Thinking controls were removed rather than merged

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Certify to 27002

    What candidates pick
    The organization seeks certification against ISO/IEC 27002.
    Why it looks right
    ISO/IEC 27002 describes the controls in detail.
    Why it's wrong
    ISO/IEC 27002 is a code of practice; certification is against ISO/IEC 27001 requirements.

    Clue to watch for Options mention certifying a guidance document.

  2. Old control count

    What candidates pick
    Annex A contains 114 controls in 14 domains.
    Why it looks right
    Many older materials still say so.
    Why it's wrong
    The 2022 edition has 93 controls in four themes; the 2013 structure no longer applies.

    Clue to watch for Question refers to the current standard.

  3. Detection for prevention

    What candidates pick
    Use vulnerability scanning to stop coding flaws.
    Why it looks right
    Scanning is a familiar control.
    Why it's wrong
    Scanning finds flaws after they exist; secure coding 8.28 prevents them during development.

    Clue to watch for Question asks which control addresses the cause.

  4. Framework required

    What candidates pick
    ISO/IEC 27001 requires adopting TOGAF or SABSA.
    Why it looks right
    Frameworks appear in the course.
    Why it's wrong
    The standard does not require any architecture framework; frameworks are optional aids.

    Clue to watch for Option uses words like required or mandatory.

  5. Procedure for everything

    What candidates pick
    Write a separate procedure for each of the 93 controls.
    Why it looks right
    Documentation seems to prove compliance.
    Why it's wrong
    Clause 7.5.1 leaves the extent of documentation to the organization based on its size, complexity and competence.

    Clue to watch for Scenario describes a small organization.

Answer framework

For control questions, start from the risk or need, then use the 2022 themes to find the best-fitting control.

  1. Restate the need or risk in one line, identifying the asset and the security property that must be protected.
  2. Decide whether the answer is a shared security service, a framework choice or a specific Annex A control.
  3. For a control, pick the theme first: organizational, people, physical or technological, then scan that theme in your printed Annex A.
  4. Prefer the control that addresses the cause over one that only detects or responds, unless the question asks about detection or response.
  5. Check that the chosen control would be justified in the Statement of Applicability and documented only to the extent needed for it to work.

Practice question

During ISMS implementation, a consultancy finds that employees regularly upload client reports to personal file-sharing services. The risk owner wants a control that stops sensitive data leaving through unapproved channels. Which Annex A control most directly addresses this?

Want more like this? The ISO 27001 LI practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Print Annex A and colour-code the four themes. Read every control title once, then read the ISO/IEC 27002 purpose statement for each of the eleven new controls and for any control you cannot explain in one sentence. Create a one-page map showing each theme's number range and its main subjects so you can jump to the right page during the open-book exam.

Next, spend an hour on security services and architecture frameworks. Write a short description of each service with two Annex A controls that implement it, and a comparison table for SABSA, TOGAF and Zachman. These topics are short but often skipped by ISO practitioners.

Then practice selection. Write fifteen one-line risks, such as lost laptops, weak supplier security or unreviewed firewall rules, and for each choose the single best control and one supporting control, noting the theme. Finally, take a small organization you know and decide what documentation its key controls really need, which builds the judgement the exam tests on clause 7.5. Finish with timed practice in blocks of twelve questions.

FAQ

What share of the exam is Domain 2, Information Security Management System Requirements?

The handbook assigns 12 of the 80 questions, or 15% of the exam. Despite the title, the knowledge statements are mostly about controls, security services and architecture frameworks.

Do I need to memorize all 93 Annex A controls?

You need to know the themes, their number ranges and what each control is broadly about. Because the exam is open book, you can confirm exact wording, but searching blindly takes too long.

Which controls are new in the 2022 edition?

Threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.

Is ISO/IEC 27002 part of the exam?

Yes, as guidance. The handbook names ISO/IEC 27002 as the source of guidance for Annex A controls, so knowing its structure and attributes helps, but requirements still come from ISO/IEC 27001.

Why are architecture frameworks in an ISO/IEC 27001 exam?

Implementers often design or adjust security architecture. Knowing how SABSA, TOGAF and Zachman structure that work helps when integrating controls, even though the standard does not require any framework.

Can an organization use controls that are not in Annex A?

Yes. Clause 6.1.3 allows controls from any source or of the organization's own design. Annex A is used to check that no necessary control was overlooked.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

See whether you can pick the right Annex A control, place it in the correct theme and explain what ISO/IEC 27002 adds.

Take the ISO 27001 LI practice test Check your ISO 27001 LI readiness

Keep going