ISO 27001 vs ISO 27002: Which One You Certify To, and How the Controls Fit Together
The two standards share the same 93 controls, which is why they are so often confused. Only one of them can be certified. Here is what each one does, how they work together, and what an auditor actually checks.
A security lead gets an email from a new enterprise customer: "Please confirm you are compliant with ISO 27002." The team has an ISO 27001 certificate on the wall. Is that the same thing? Does the customer want a second certificate?
Usually not. The difference between ISO 27001 and ISO 27002 is the difference between a requirement and a guide. This article explains both from a certification body's point of view, so you know which one to certify to and how to use the other.
Quick answer: ISO/IEC 27001 sets the requirements for an information security management system (ISMS), and it is the standard organizations are certified to. ISO/IEC 27002 is guidance on how to implement the 93 information security controls listed in Annex A of ISO 27001. You cannot be certified to ISO 27002. You use it to design and run the controls you include in your ISO 27001 Statement of Applicability.
What Are ISO 27001 and ISO 27002?
ISO/IEC 27001:2022
The requirements for building, running and improving an ISMS: clauses 4 to 10, plus Annex A, a list of 93 controls. Accredited certification bodies audit against it and issue certificates.
ISO/IEC 27002:2022
A 152-page guide published in February 2022. For each of the same 93 controls, it explains the purpose and gives implementation guidance. It contains no requirements you can be audited against.
Think of ISO 27001 as the rulebook for the whole system, and ISO 27002 as the handbook for the controls inside it. You can read our full guide to ISO 27001 requirements for the clauses and Annex A list.
ISO 27001 vs ISO 27002: Side-by-Side Comparison
| Point | ISO/IEC 27001 | ISO/IEC 27002 |
|---|---|---|
| Type | Requirements standard ("shall") | Guidance standard ("should") |
| Can you be certified? | Yes, by an accredited certification body | No |
| What it covers | The whole ISMS: context, leadership, risk, support, operation, evaluation, improvement | The 93 controls only |
| Controls | Listed in Annex A with a one-line description each | Each control explained with purpose and guidance |
| Control attributes | Not included | Five attribute types to filter and map controls |
| Who uses it | Management, auditors, customers checking certificates | Security and IT teams designing controls |
| Current edition | ISO/IEC 27001:2022 | ISO/IEC 27002:2022 |
How ISO 27001 and ISO 27002 Work Together
The two standards meet at one document: the Statement of Applicability (SoA). Under clause 6.1.3 of ISO 27001, you compare the controls you need against Annex A, and record which controls apply, why, and whether they are in place.
- Risk assessment (ISO 27001 clause 6.1.2). Identify your information security risks.
- Risk treatment (clause 6.1.3). Choose controls to treat them, checking Annex A so nothing needed is missed.
- Statement of Applicability. List every Annex A control with your decision and justification.
- Implementation, using ISO 27002. Use the guidance for each control to decide how it will work in your organization.
- Audit. The auditor tests your controls against your own SoA, policies and records, not against ISO 27002 wording.
Getting ready for an ISO 27001 audit? See how our accredited certification works, from scope review to certificate.
See ISO 27001 certificationThe 93 Controls and Five Attributes in ISO 27002
ISO 27002:2022 groups the 93 controls into four themes, the same grouping used in ISO 27001 Annex A:
| Theme | Controls | Examples |
|---|---|---|
| Organizational (5.x) | 37 | Policies, threat intelligence, supplier security, cloud services |
| People (6.x) | 8 | Screening, awareness training, remote working |
| Physical (7.x) | 14 | Physical entry, clear desk, equipment security |
| Technological (8.x) | 34 | Access rights, logging, backup, secure coding |
The 2022 edition also added attributes, which let you sort controls in different ways. This is useful when you map ISO 27001 to other frameworks, such as SOC 2 or NIST CSF.
| Attribute type | Values |
|---|---|
| Control type | Preventive, detective, corrective |
| Information security properties | Confidentiality, integrity, availability |
| Cybersecurity concepts | Identify, protect, detect, respond, recover |
| Operational capabilities | 15 capabilities, such as governance, asset management, identity and access management, and continuity |
| Security domains | Governance and ecosystem, protection, defence, resilience |
The cybersecurity concepts match the functions in the NIST Cybersecurity Framework, which helps teams that run both. See our comparison of NIST CSF vs ISO 27001.
What an ISO 27001 Auditor Checks, and Where ISO 27002 Comes In
An accredited auditor audits you against ISO 27001, your risk assessment and your Statement of Applicability. ISO 27002 helps both sides understand what a control is meant to achieve, but it is not a checklist the auditor grades you on.
- Every Annex A control appears in your SoA, with a reason for including or excluding it.
- Included controls trace back to risks in your risk assessment.
- Controls work in practice, shown by records such as access reviews, logs, backups and training.
- Exclusions are justified, for example because a control does not apply to anything in your scope.
Read more about how to get ISO 27001 certified, including Stage 1 and Stage 2, or see whether parts of the audit can run online in our guide to remote ISO audits.
Other Standards in the ISO 27000 Family
| Standard | What it does | Certifiable? |
|---|---|---|
| ISO/IEC 27000 | Overview and vocabulary | No |
| ISO/IEC 27001 | ISMS requirements | Yes |
| ISO/IEC 27002 | Guidance on the 93 controls | No |
| ISO/IEC 27003 | Guidance on implementing an ISMS | No |
| ISO/IEC 27005 | Guidance on information security risk management | No |
| ISO/IEC 27006-1 | Requirements for bodies that certify ISO 27001 | Applies to certification bodies |
| ISO/IEC 27701 | Privacy information management | Yes |
Handling personal data as well? See ISO 27701 certification. Selling software? Our page on ISO 27001 for SaaS explains how to scope a cloud product.
What to Tell a Customer Who Asks for ISO 27002
When a customer asks for "ISO 27002 compliance", they usually want assurance that your controls follow recognized good practice. An accredited ISO 27001 certificate, with your SoA available under NDA, normally answers that. Explain that ISO 27002 cannot be certified, and that your ISO 27001 controls are designed using its guidance. Customers can check our certificates on our certificate verification page.
Want to audit ISO 27001 yourself?
Learn to plan, lead and report ISMS audits against ISO/IEC 27001:2022.
ISO 27001 Certification with Accredify Global
Accredited
ISO/IEC 27001 is in our UAF accreditation scope, under the IAF MLA.
Senior auditor
A senior auditor leads your Stage 1 and Stage 2 audits.
Remote or hybrid
Cloud-first teams can be audited largely online, in line with the accreditation rules.
Fixed fee
One fixed-fee proposal for your real scope, with no hidden costs or scope creep added later. See ISO 27001 certification cost.
Planning ISO 27001 certification?
Tell us your scope, people and systems. We'll explain the audit, the days it needs, and send one fixed-fee proposal.
Book your free scope review →ISO 27001 vs ISO 27002 FAQ
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 sets the requirements for an information security management system, and organizations are certified to it. ISO 27002 is guidance on how to implement the 93 controls listed in ISO 27001 Annex A. It explains each control but contains no requirements you can be certified against.
Can you get ISO 27002 certified?
No. ISO 27002 is a guidance standard, so there is no ISO 27002 certificate. Organizations are certified to ISO 27001 by an accredited certification body, and use ISO 27002 to design their controls.
Do I need ISO 27002 to get ISO 27001 certified?
It is not required, but most teams find it very useful. ISO 27001 Annex A gives each control in one line, while ISO 27002 explains its purpose and how to implement it.
Are ISO 27001 Annex A and ISO 27002 the same controls?
Yes. Both 2022 editions use the same 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological. Annex A lists them, and ISO 27002 explains them.
What are the control attributes in ISO 27002?
ISO 27002:2022 tags each control with five attribute types: control type, information security properties, cybersecurity concepts, operational capabilities and security domains. They help you filter controls and map them to other frameworks.
Which version of ISO 27002 is current?
ISO/IEC 27002:2022, published in February 2022. It replaced the 2013 edition and matches the controls in ISO/IEC 27001:2022.
Does an ISO 27001 auditor audit against ISO 27002?
No. The auditor audits against ISO 27001, your risk assessment and your Statement of Applicability. ISO 27002 helps explain what a control should achieve, but it is not the audit criteria.
A customer asked us for ISO 27002 compliance. What should we send?
Usually your accredited ISO 27001 certificate, and your Statement of Applicability under NDA if they ask. Explain that ISO 27002 cannot be certified and that your controls follow its guidance.
Does Accredify Global certify ISO 27001?
Yes. ISO/IEC 27001 is in our UAF accreditation scope. A senior auditor leads every audit, and you get one fixed-fee proposal after a free scope review.