ISO 27001 vs. ISO 27002: what is the difference?
ISO 27001 and ISO 27002 belong together, but they serve different purposes. ISO 27001 is the standard you are certified against. ISO 27002 is a guideline that explains how to fill in the measures. Both are available in the Netherlands from NEN . This page explains the difference clearly.
In short: ISO 27001 says what you must do, and ISO 27002 explains how you can approach it. You can only be certified against ISO 27001, not ISO 27002.
ISO 27001 vs. ISO 27002: the short answer
ISO 27001 is the certifiable standard. It describes the requirements for an Information Security Management System (ISMS) in clauses 4 to 10, plus a list of 93 controls in Annex A.
ISO 27002 is the implementation guide. For each control in Annex A, it gives detailed explanation, examples and best practices. It is a tool, not a standard that an auditor tests you against.
| Aspect | ISO 27001 | ISO 27002 |
|---|---|---|
| Type | Standard (requirements) | Guideline (implementation guide) |
| Certifiable | Yes | No |
| What it says | What you must have | How to fill it in |
| Contains | ISMS requirements + Annex A | Explanation per control |
| Role in the audit | The auditor tests against it | Background, not tested |
| Mandatory | Yes, for certification | No, but very useful |
What is in ISO 27001?
ISO 27001 describes the requirements for your management system for information security. The requirements of the standard are in clauses 4 to 10: context, leadership, planning, support, operation, evaluation and improvement.
In addition, ISO 27001 contains in Annex A a reference list of 93 controls. For each control, it only gives a short title and an objective. Example: A.8.5 “Secure authentication”. The standard does not say how to set up secure authentication.
What is in ISO 27002?
ISO 27002 takes the same 93 controls and elaborates on them. For each control, you read what the intention is, how you can implement it and what to watch out for. For A.8.5 “Secure authentication”, for example, ISO 27002 explains password policy, multi-factor authentication and limiting login attempts. You can read how ISO 27002 is structured and how to use the attributes on what is ISO 27002.
Most organisations buy both standards. ISO 27001 to know what you must comply with, ISO 27002 to understand how to implement the controls in practice.
When do you use which?
You use both, but at different points in your project.
| Situation | Which standard |
|---|---|
| Getting certified | ISO 27001 (that is the standard) |
| Understanding what the standard requires | ISO 27001 |
| Implementing a control in practice | ISO 27002 |
| Unsure what a control should look like | ISO 27002 |
| Drafting the statement of applicability | ISO 27001 (Annex A) + ISO 27002 as explanation |
In your step-by-step plan, you use ISO 27001 as the framework and ISO 27002 as a reference when introducing measures.
The 2022 updates of both standards
Both standards were revised in 2022, and they align with each other.
ISO 27001:2022 reorganised Annex A: from 114 controls in 14 categories to 93 controls in four themes (organisational, people, physical and technological). 11 new controls were added, such as threat intelligence and cloud security.
ISO 27002:2022 followed the same new structure and added so-called attributes to each control. This lets you filter controls by, for example, type (preventive, detective, corrective) or security property. Read more about the changes on the current changes page.
More information
- What is ISO 27001?: introduction to the standard
- Requirements of the standard: all clauses explained
- Annex A: the 93 controls
- Comparison with other standards: SOC 2, NEN 7510, NIS2 and more
- ISO 27002:2022 at ISO.org : the official implementation guide