ISO 27001 vs ISO 27002
Two standards, one control list, and a single certificate.
People mix up ISO/IEC 27001 and ISO/IEC 27002 because their control lists line up number for number. The split is simple once you see it: one is written to be audited, the other is written to help you build. This page sorts out which you buy, which you cite in a contract, and which a customer can actually check.
Back to ISO 27001 services01 · Which is audited
Only one of the pair can be audited
ISO/IEC 27001 contains requirements. ISO/IEC 27002 contains advice. Certification needs requirements, so it attaches to 27001 alone.
A requirement is something an auditor can mark as met or not met. ISO/IEC 27001:2022 is written that way in its clauses 4 to 10 and in Annex A. ISO/IEC 27002:2022 describes good practice and leaves the choices with you, which helps a security engineer and gives an auditor nothing to pass or fail. That is the whole reason no accredited scheme certifies anyone to 27002.
A quick test for any claim
If a document says a company is certified to ISO 27002, ask to see the certificate. What arrives will either be an ISO 27001 certificate described carelessly, or nothing a certification body issued.
02 · Which to open
Which one to open, question by question
Most of the confusion goes away when you start from the question you have rather than from the standard's number.
| Your question | Open | Why that one |
|---|---|---|
| What must our ISMS do to pass an audit? | ISO/IEC 27001 | Its clauses are the test the auditor applies |
| Which controls must we at least consider? | ISO/IEC 27001, Annex A | Annex A is the list your Statement of Applicability (SoA) must account for |
| How should we set up a control we selected? | ISO/IEC 27002 | It gives the purpose of each control and practical guidance on it |
| Which of our controls detect rather than prevent? | ISO/IEC 27002 | Its attribute tags let you sort controls that way |
| How do we run risk assessment well? | ISO/IEC 27005 | The family's risk guidance; 27001 only sets the outcome |
| What exactly does a term like nonconformity mean? | ISO/IEC 27000 | The shared vocabulary for the whole family |
In a contract, the verb decides the duty. Maintaining ISO 27001 certification commits a supplier to external audits every year. Following ISO 27002 guidance commits them to a design approach that nobody outside the company checks.
03 · One control, two ways
Following one control through both documents
Take 8.13 Information backup. The number and name are identical in both standards; what changes is how much each one says.
In ISO 27001 Annex A
A brief, requirement-level statement
- Short enough to fit on one row of your SoA
- Names the outcome, not the method
- Leaves you to decide whether it applies, and to say why
In ISO 27002
Several paragraphs of guidance
- Explains what the control is for
- Works through the practical questions: coverage, frequency, where copies live, how restores are proved
- Adds attribute tags and pointers to related controls
Neither standard's text is reproduced here; both are copyrighted. The descriptions are ours.
The same pattern repeats across all 93 controls, numbered 5.1 to 8.34 in both documents: 37 organizational, 8 people, 14 physical and 34 technological. Your SoA records a decision against the Annex A entry. Your backup procedure is where the 27002 guidance shows up, adapted to your own systems. An auditor reads the first and samples the second.
05 · Why two documents
Why there are two documents at all
Requirements and guidance have lived in separate documents since the British original, and the two are revised together.
| Year | What happened |
|---|---|
| 1995 | BS 7799 appears in the UK as a code of practice |
| 1999 | A second part, BS 7799-2, describes a management system that can be certified |
| 2000 | The code of practice is adopted internationally as ISO/IEC 17799 |
| 2005 | The certifiable part becomes ISO/IEC 27001 |
| 2007 | ISO/IEC 17799 takes the number ISO/IEC 27002 |
| 2013 | Both are revised together |
| February 2022 | ISO/IEC 27002:2022 regroups its controls into four themes |
| October 2022 | ISO/IEC 27001:2022 brings Annex A into line with that regrouping |
| 31 October 2025 | Certificates to the 2013 edition reach the end of their transition period |
The 2022 revision of 27002 also renamed it. The phrase code of practice disappeared from the title, and cybersecurity and privacy protection were added to it, a sign that the guidance now reaches beyond classic information security.
06 · Reading claims
Four claims you will meet, and what each one is worth
Sales decks and security questionnaires use the two numbers loosely. Here is how to read them.
- We are ISO 27001 certified
- Worth checking. Ask for the certificate, the issuing body and the scope, and confirm the scope covers what you are buying.
- We are ISO 27002 certified
- Cannot be true as worded. Ask which certificate they actually hold.
- Our controls align with ISO 27002
- A design statement nobody has independently tested. Ask for evidence, as you would for any self-assessment.
- We follow ISO 27001 but are not certified
- Possibly a working ISMS, but with no external audit behind it. Weigh it like the alignment claim.
Sources: ISO/IEC 27001:2022 and ISO/IEC 27002:2022 (titles, structure, control numbers and attribute names only; all descriptions are Auditify's own wording); ISO/IEC 27000, 27005 and 27701 catalogue entries on iso.org; IAF MD 26 on the transition to ISO/IEC 27001:2022; BSI material on the history of BS 7799.
Questions about the pair
Is ISO 27002 the newer version of ISO 27001?
No. They are companion standards, revised together.
The numbers suggest a sequence, but there is none. 27001 holds the requirements and 27002 holds the guidance, and each 2022 edition replaced its own 2013 edition. Neither supersedes the other.
Does a certification auditor use ISO 27002?
Not as the test, but often as a reference point.
Findings must trace to a 27001 requirement. When an auditor judges whether a control is designed sensibly, though, recognised practice is the natural yardstick, and 27002 is the most common written version of it. Departing from it is allowed; be ready to explain why your approach still works.
We are not seeking certification. Is ISO 27002 enough on its own?
It can shape your controls, but it gives you no management system.
27002 helps you set controls up well. It does not give you the risk process, internal audit, management review and improvement loop that 27001 requires, and those are what keep controls working after the first year.
Did the 2022 editions change the control numbers?
Yes. The 2013 numbering no longer applies.
The 2013 controls were numbered A.5 to A.18. The 2022 ones run from 5.1 to 8.34. ISO/IEC 27002:2022 includes a correspondence table between old and new, which is the quickest way to update an older SoA.
Do we need to buy ISO 27002?
Not to get certified. Many teams find it worth having.
Certification needs ISO 27001 only, and you should hold the real text rather than a summary of it. 27002 earns its cost when control owners need practical direction, or when you want the attribute tags for mapping and reporting.
Build from the guidance, get audited on the requirements.
An ISO 27001 gap analysis from Auditify tests your ISMS against the clauses and Annex A of 27001, and draws on 27002 practice when we judge whether a control will hold up.