Security teams and compliance professionals encounter ISO 27001 and ISO 27002 together often enough that the two get conflated. They are part of the same standard family and share the same control structure. But the difference between ISO 27001 and ISO 27002 is significant, and confusing them leads to practical problems during implementation and audit preparation.

One is a certifiable management system standard with auditable requirements. The other is a reference guide for implementing security controls. Neither replaces the other. Used together, they give organizations both the framework and the technical depth needed to build a credible Information Security Management System.

This article breaks down how the two standards relate, where they diverge, and what that means for organizations pursuing ISO 27001 certification.

What ISO 27001 Actually Is

ISO/IEC 27001 is the international standard that sets requirements for establishing, implementing, maintaining, and improving an ISMS. It is certifiable. Organizations can be audited against it by an accredited certification body and receive formal ISO 27001 certification.

The standard is built around Clauses 4 through 10, which define what an organization must do to operate a functioning ISMS. These clauses cover scope definition, leadership commitment, risk assessment methodology, risk treatment, documentation, internal audit, management review, and continual improvement. Every clause is mandatory.

In addition to those clauses, ISO 27001 includes Annex A. This is a reference set of 93 information security controls, grouped into four themes: organizational, people, physical, and technological. Organizations use Annex A to select controls based on their risk treatment decisions, and they document those choices in the Statement of Applicability. Annex A does not tell organizations how to implement each control. That guidance lives elsewhere.

ISO 27001 certification is what clients, enterprise procurement teams, and regulators ask for. It signals that an independent auditor has verified the ISMS against a recognized international standard.

What ISO 27002 Actually Is

ISO/IEC 27002:2022 is a guidance document, not a certifiable standard. Organizations cannot get certified against ISO 27002. No certification body issues an ISO 27002 certificate. It exists to support implementation.

ISO 27002 goes control by control through the same 93 controls listed in ISO 27001’s Annex A. For each one, it provides the control’s purpose, what it is designed to achieve, and practical ISO 27002 implementation guidance for putting it into operation. Where Annex A in ISO 27001 gives you one sentence per control, ISO 27002 expands that into a full page of context, rationale, and recommended approaches.

The 2022 version introduced a notable structural addition: five control attributes. Each control is tagged with a type (preventive, detective, or corrective), security property (confidentiality, integrity, or availability), concept alignment to cybersecurity frameworks, operational capability, and security domain. These attributes help organizations filter and map controls in ways that the 2013 version did not support.

ISO 27002 is most useful during the implementation phase, when a security team needs to understand not just which controls apply, but how to design and evidence them.

The Core Difference Between ISO 27001 and ISO 27002

The clearest way to understand the difference between ISO 27001 and ISO 27002 is through the lens of requirements versus guidance. ISO 27001 defines what must be in place. ISO 27002 explains how to build it.

ISO 27001 is auditable. Every clause is a requirement. An auditor will test whether your organization actually meets it. Non-compliance triggers a non-conformity, which can delay or prevent certification.

ISO 27002 is not auditable in the same way. Its recommendations are best practices, not binding mandates. An organization can choose not to follow specific ISO 27002 guidance and still certify against ISO 27001 – provided its chosen controls are justified by its risk assessment and documented in the Statement of Applicability.

Another key distinction is scope. ISO 27001 vs ISO 27002 controls differ in depth rather than content. Both reference the same 93 controls. But ISO 27001 lists them briefly in Annex A, while ISO 27002 devotes detailed sections to each one. The dependency runs one way: ISO 27002 supports ISO 27001, but ISO 27001 does not require organizations to follow ISO 27002 guidance verbatim.

ISO 27001 Annex A Controls and How ISO 27002 Expands Them

ISO 27001 Annex A controls are organized across four themes in the 2022 version: organizational (37 controls), people (8 controls), physical (14 controls), and technological (34 controls). The 2022 revision reduced the previous 114 controls in 14 domains down to 93 controls, consolidating some, splitting others, and adding 11 entirely new ones.

The 11 new controls address areas that were either absent or underdeveloped in the 2013 version. These include threat intelligence (A.5.7), information security for cloud services (A.5.23), ICT readiness for business continuity (A.5.30), web filtering (A.8.23), and data masking (A.8.11). Any organization still working from a 2013-era documentation framework needs to address these gaps explicitly.

For each of those 93 ISO 27001 Annex A controls, ISO 27002 provides expanded detail. Consider control A.8.24 on the use of cryptography. Annex A states the control in a single sentence. ISO 27002 expands that into guidance on cryptographic policy design, key management practices, and implementation considerations across different environments.

The ISO 27002 security controls explained in this way become actionable. Security teams building policies and procedures for access control, incident management, or backup management can open ISO 27002 to understand what good practice looks like for each control. That is the document’s primary function – a technical reference that makes ISO 27002 implementation guidance practical.

ISO 27001 Requirements vs Guidelines: Why the Distinction Matters

Understanding ISO 27001 requirements vs guidelines has direct consequences for how organizations prepare for certification audits.

ISO 27001 requirements are non-negotiable. Clauses 4 through 10 must be met. An auditor will ask for evidence. If your organization cannot demonstrate that a risk assessment was conducted using a defined methodology, or that management reviewed the ISMS, those become formal findings. Two or more major non-conformities can prevent certification until they are resolved.

The guidelines set out in ISO 27002 are merely recommendations and auditors do not evaluate organizations on the basis of them. An organization may implement a control in a manner that differs from the guidance of ISO 27002 without being regarded as non-compliant, as long as the approach taken actually deals with the relevant risk and is documented. Auditors are concerned with whether the control is effective, not with whether it follows the method suggested by ISO 27002.

This difference is most important in cases where organizations are dealing with limited resources. The requirements set out in ISO 27001 specify the minimum scope necessary for certification. ISO 27002 assists teams in understanding how to properly implement controls. When organizations regard the guidance in ISO 27002 as binding requirements, they sometimes go overboard with their ISMS by including a large amount of documentation and controls that do not correspond with their real risk situation. As a result, they incur extra costs without gaining any additional security value.

How to Use Both Standards Together

The ISO 27001 and ISO 27002 relationship is designed to be complementary. ISO 27001 defines the management system and the certification requirement. ISO 27002 provides the technical substance for making that system work.

In reality, organisations put them into use at various stages of the implementation process. ISO 27001 has an influence on the project structure by defining the scope, the risk assessment method, the choice of controls, the documentation requirements, the audit programme, and the management reviews. Meanwhile, ISO 27002 is applied when the security teams begin to design and document the individual controls, like the access control policy, the encryption standards, the supplier security requirements, and the like.

The Statement of Applicability is where the two standards meet. It documents which of the 93 ISO 27001 Annex A controls the organization has selected, which it has excluded, and the justification for each decision. ISO 27002’s expanded guidance helps teams write those justifications with precision and design controls that will hold up under audit scrutiny.

For organizations managing compliance obligations beyond ISO 27001, the two standards together also support adjacent programmes. An ISMS built to ISO 27001 with controls documented using ISO 27002 guidance covers a significant portion of the requirements under frameworks like NIST CSF, DPDPA, and AI governance frameworks. The third-party risk management requirements in ISO 27001 Annex A also align closely with supplier oversight obligations under various regulatory regimes.

CyRAACS supports organizations working through both standards. Our GRC services and technical security validation help ensure that the controls selected in the SoA are not just documented but actually functioning. Contact us to discuss your ISO 27001 programme.

FAQs About ISO 27001 vs ISO 27002

Can an organization get certified against ISO 27002?

No. ISO 27002 is not a certifiable standard. Certification is only available against ISO 27001, through an accredited certification body. ISO 27002 serves as implementation guidance and does not have its own audit or certification process.

Do organizations need ISO 27002 to achieve ISO 27001 certification?

Not formally. ISO 27001 does not require organizations to reference ISO 27002 explicitly. However, ISO 27002 is the most practical resource for understanding how to implement the Annex A controls, and most implementation teams use it during the design phase.

How does the ISO 27001 and ISO 27002 relationship work in a certification audit?

Auditors evaluate organizations in terms of the ISO 27001 requirements and not the ISO 27002 guidance. The certification body examines the SoA, the risk treatment documentation and the evidence that the controls were operated. It is ISO 27002 that helps in designing controls so that they will stand up to this kind of review.

What are the 11 new controls added in the 2022 update?

The 11 new controls in ISO 27001:2022 Annex A include threat intelligence (A.5.7), cloud service security (A.5.23), ICT readiness for business continuity (A.5.30), physical security monitoring (A.7.4), configuration management (A.8.9), information deletion (A.8.10), data masking (A.8.11), data leakage prevention (A.8.12), web filtering (A.8.23), and secure coding (A.8.28). Each has corresponding implementation guidance in ISO 27002:2022.

Is ISO 27002 guidance mandatory for third-party assessments?

It is not obligatory. Although certain organizations and procurement frameworks regard ISO 27002 as a basic standard for vendor security requirements, the advice it provides is merely advisory and not binding. Certification under ISO 27001 is the usual requirement from a third party.

Conclusion

The difference between ISO 27001 and ISO 27002 comes down to one clear line: one sets auditable requirements, the other provides implementation depth. Organizations pursuing certification need both – ISO 27001 to define the management system and pass the audit, and ISO 27002 to build controls that hold up in practice. CyRAACS helps organizations work through both standards as part of a structured certification programme, combining compliance consulting with technical security assessment to get ISMSs audit-ready. Reach out to discuss your ISO 27001 scope.