Each control has a tag set (Control type / Information security properties / Cybersecurity concepts / Operational capabilities / Security domains), followed by Control, Purpose, and Guidance sections.

A 27002 control looks like:

8 Technological controls       ← one of four themes
8.1 User endpoint devices      ← one of ~93 controls

| Control type | Information     | Cybersecurity | Operational             | Security    |
|              | security props  | concepts      | capabilities            | domains     |
| #Preventive  | #Confidentiality| #Protect      | #Asset_management       | #Protection |
|              | #Integrity      |               | #Information_protection |             |
|              | #Availability   |               |                         |             |

Control:    "Information stored on, processed by or accessible via user endpoint devices
             should be protected."

Purpose:    "To protect information against the risks introduced by using user endpoint
             devices."

Guidance:   General — establish topic-specific policy for endpoint configuration etc.
            a) the type of information and classification level that the endpoint can handle
            b) registration of user endpoint devices …

The tag set ("#Preventive", "#Identify", etc.) is new in the 2022 revision — it lets you slice the catalogue by NIST CSF function, CIA goal, or operational capability.

Tip: The tags exist to map 27002 controls to other frameworks: filter on #Protect to see what NIST CSF Protect functions correspond, or #Confidentiality for everything that defends C in CIA. Hugely useful for unified GRC dashboards.

Go deeper:

• ISO/IEC 27002:2022 — themes, attributes and control layout — the four themes and the 2022 attribute tags that let you slice controls by NIST CSF function or CIA goal.

Risk = Eintrittshäufigkeit × Schadensausmass — frequency of occurrence × magnitude of damage.

The standard formula, with units:

• Eintrittshäufigkeit (occurrence frequency): [# / year]
• Schadensausmass (damage magnitude): [CHF] — value of the exposed assets
• Risiko (risk): [CHF / year] — an annualised expected loss

So a threat that hits once per 10 years and causes CHF 1 M of damage carries a risk of CHF 100k/year. A nuisance that hits 10× per year and costs CHF 100 carries CHF 1k/year — the rare-but-catastrophic event is the bigger problem.

Why this matters:

• Comparability: annualised CHF lets you compare a flood risk with a phishing risk on the same axis.
• Budgeting: if a control costs CHF 50k/year and reduces a CHF 100k/year risk, you've broken even on math grounds.
• Limits: the formula is an expected value — it hides variance. A 1% chance of CHF 100M loss is the same expected loss as a 10% chance of CHF 10M, but the first can bankrupt you.

Go deeper:

• Risk (Wikipedia) — the expected-value definition, risk = probability × expected loss (summed over scenarios).