: It uses the control descriptions in ISO 27002 as the basis for what should be assessed, offering specific testing methods for those controls. Key Assessment Techniques
ISO 27008 applies to all types of organizations, regardless of their size or industry. It is relevant to organizations that have implemented an ISMS, as well as those that are planning to implement one. iso 27008
Here is the text for :