Both standards are in their 2022 editions: ISO/IEC 27001:2022 and ISO/IEC 27002:2022.
What is the difference between ISO 27001 and ISO 27002?
ISO/IEC 27001 sets the requirements for an information security management system (ISMS) and is the standard organisations are certified against. ISO/IEC 27002 is a guidance document that describes the controls in Annex A of ISO/IEC 27001 with their purpose and implementation guidance. One standard sets out what an organisation has to demonstrate; the other explains what each control is for and how to implement it.
Confusing the two is costly in both directions. Buy only ISO/IEC 27002 and you have nothing a certification body could examine. Buy only ISO/IEC 27001 and Annex A gives you a terse reference list, leaving you to interpret the scope of each control yourself.
How do Annex A and ISO 27002 relate?
Annex A of ISO/IEC 27001 and ISO/IEC 27002 contain the same 93 controls under the same numbers. They fall into four themes:
| Theme | Controls | Numbers |
|---|---|---|
| Organisational | 37 | 5.1 to 5.37 |
| People | 8 | 6.1 to 6.8 |
| Physical | 14 | 7.1 to 7.14 |
| Technological | 34 | 8.1 to 8.34 |
Annex A is part of the requirements standard and the reference point for the Statement of Applicability. In it, the organisation justifies including or excluding each control. ISO/IEC 27002 is a document in its own right and serves in the audit to interpret controls, not as the yardstick.
Which standard does the certification body audit against?
An accredited certification body audits against clauses 4 to 10 of ISO/IEC 27001 and against the controls set out in the Statement of Applicability. In Germany, DAkkS accredits certification bodies. ISO/IEC 17021-1 applies to them, and ISO/IEC 27006-1:2024 specifically for ISMS.
The certification cycle covers three years as the default case, with annual surveillance audits. The guide to ISO 27001 certification sets out the process from preparation to recertification.
Side by side
| Criterion | ISO/IEC 27001 | ISO/IEC 27002 |
|---|---|---|
| Purpose | Sets out the requirements an information security management system has to meet. It describes what an organisation has to be able to demonstrate. | Describes the information security controls in detail, with purpose and implementation guidance. It shows what an individual control is for and how to implement it. |
| Legal character and binding force | A requirements standard. Clauses 4 to 10 are binding once conformity is claimed. The standard is not legally mandatory; it becomes binding through contracts, tenders or a decision by top management. | A guidance document with recommendations. Because the standard sets no requirements, conformity with it cannot be claimed. |
| Certifiability | Certifiable. Certification is carried out by an accredited certification body; in Germany, accreditation is granted by DAkkS. | Not certifiable, because the standard contains no requirements for a management system. |
| What is covered | Covers the entire management system, in clauses 4 to 10. | Covers the level of the controls. The management system requirements of clauses 4 to 10 are found only in ISO/IEC 27001. |
| Structure | Clauses 4 to 10 following the harmonised structure for ISO management system standards, plus Annex A with 93 reference controls in short form. | Four themes holding 93 controls: 37 organisational, 8 people, 14 physical and 34 technological. |
| Level of detail on the controls | Annex A lists the controls as a terse reference list without implementation guidance. | Describes the same controls with purpose and implementation guidance. |
| Numbering and how controls are cited | Annex A numbers the controls within each theme from 5.1 to 8.34. Under that number a control appears in the Statement of Applicability, in the audit report and in customer questionnaires. | ISO/IEC 27002:2022 uses the same numbering. A number denotes the same control in both documents. |
| Attributes as a second ordering principle | Annex A orders the controls by the four themes. | Additionally gives each control attributes and a statement of purpose; both were added with the 2022 edition. The attributes allow the catalogue to be sorted by criteria other than the theme. |
| How they work together | Sets the framework and points, via Annex A, to the catalogue of controls. The scope of a control is only set out in the explanations of ISO/IEC 27002. | Explains Annex A of ISO/IEC 27001. It does not replace the requirements standard but supplements it with the substantive interpretation. |
| Role in the audit | The basis for the audit. Auditors examine conformity with the requirements of clauses 4 to 10 and with the controls set out in the Statement of Applicability. | Not a basis for the audit; it is consulted to interpret a control, but is not itself the object of examination. |
| What has to be evidenced | Requires documented information, including the policy, the scope, risk assessment and risk treatment, the Statement of Applicability, internal audits and the management review. | Requires no evidence. Evidence only arises where a control is implemented and substantiated within an ISO/IEC 27001 management system. |
| Effort | The effort sits in building and running the management system: roles, processes, documentation and the recurring audit cycle. | No separate effort for a management system. Time goes into reading, interpreting and translating the controls to your own organisation. |
| Who needs it | Organisations that need a certificate, or that want to demonstrate a defensible ISMS to customers, insurers and supervisory authorities. | Everyone who implements controls in concrete terms: security officers, IT operations and the business functions. Usable as a structured catalogue even without any intention to certify. |
| Position within the 27000 family | The requirements standard for the ISMS and the standard organisations have their ISMS certified against. Other standards in the family that set requirements cover other subjects, such as ISO/IEC 27701 for the privacy information management system. | One of several guidance documents in the family, alongside ISO/IEC 27003 on implementing the ISMS, ISO/IEC 27004 on monitoring and measurement and ISO/IEC 27005 on managing information security risks. |
| Edition and availability | ISO/IEC 27001:2022, with Amendment 1:2024 on climate action, which ISO provides free of charge. The standard itself is sold for a fee. | ISO/IEC 27002:2022. Likewise sold for a fee. |
Our verdict
If you need a certificate, you need ISO/IEC 27001; if you have to write out controls and justify them in the audit, you also need ISO/IEC 27002. If all you want is an internationally agreed catalogue of controls without building a management system, ISO/IEC 27002 on its own is enough. That applies, for example, to an internal security policy or a checklist for assessing a service provider.
In which order do you use the two standards?
The order decides whether the ISMS can be justified in the audit:
- Define the scope under ISO/IEC 27001.
- Assess the risks within the scope.
- Derive the controls from risk treatment.
- Compare the result with Annex A (clause 6.1.3).
- Check in ISO/IEC 27002 what each selected control is meant to achieve.
- Record the selection and the reasoning in the Statement of Applicability.
Working through the 93 controls from top to bottom produces documentation instead. It leaves you unable to explain in the audit why the ISMS has taken its shape.
Which other standards belong to the ISO 27000 family?
Besides 27001 and 27002, the family includes a free overview standard, further guidance documents, two cloud standards and separate requirements standards for privacy management systems and certification bodies.
| Standard | Subject | Relationship to ISO/IEC 27001 |
|---|---|---|
| ISO/IEC 27000:2026 | Overview of the family, its concepts and the relationships between the standards; free of charge from ISO | places ISO/IEC 27001 within the family |
| ISO/IEC 27001:2022 | Requirements for the ISMS, with Annex A | the standard the ISMS is certified against |
| ISO/IEC 27002:2022 | Description of the 93 controls with purpose and implementation guidance | explains Annex A |
| ISO/IEC 27003:2017 | Explanation and guidance on ISO/IEC 27001 | accompanies clauses 4 to 10 |
| ISO/IEC 27004:2016 | Guidance on monitoring, measurement, analysis and evaluation | underpins clause 9.1 |
| ISO/IEC 27005:2022 | Guidance on managing information security risks | supports risk assessment and risk treatment |
| ISO/IEC 27017:2026 and 27018:2025 | Controls and guidance for cloud services and for personal data in public clouds | build on the ISO/IEC 27002 catalogue |
| ISO/IEC 27701:2025 | Requirements and guidance for a privacy information management system (PIMS) | its own requirements for handling personal data |
| ISO/IEC 27006-1:2024 | Requirements for bodies that certify ISMS | addressed to the certification body, not to your organisation |
Both standards on one asset estate: Rizzqo
Rizzqo carries ISO/IEC 27001 and ISO/IEC 27002 as two requirement catalogues over the same asset estate. ISO/IEC 27001 covers the management system, ISO/IEC 27002 the controls. The requirements appear on the systems, services, sites and providers they are assigned to through category and subcategory. When an object's classification changes, its requirement list adjusts.
The owner of an object answers the requirements of both layers in one pass and attaches the evidence in the same place. Each answer is finalised with a name and a timestamp. Rizzqo computes coverage from the finalised answers, and an open requirement stays on the object as an open point. Tasks to close gaps can be synchronised with Jira in both directions.