International Organization for Standardization (ISO) standard 27002 provides guidance for compliance by outlining

ISO/IEC 27002 serves as a supplementary code of practice to ISO 27001, providing detailed guidance on implementing the information security controls listed in Annex A of ISO 27001. It covers control categories such as access control, cryptography, physical security, and incident management, giving organizations actionable guidance for building a security control framework. Organizations use it to select controls appropriate to their specific risk environment.

Financial soundness and business viability metrics fall outside the scope of ISO 27002, which is focused exclusively on information security controls and their implementation.

Configuration management best practices are addressed by standards such as ITIL and ISO/IEC 20000, not by ISO 27002.

Contract agreement writing standards are a legal and procurement concern not addressed by ISO 27002, which deals with information security control guidance.