Applied AI & Cybersecurity
What is the difference between ISO 27001 and ISO 27002?
One is the requirement. The other is the guidance.
Every great mission starts with reconn.
ISO/IEC 27001 sets the requirements for an information security management system and can be certified. ISO/IEC 27002:2022 gives guidance on information security controls and cannot be certified. You use 27001 to run the management system and 27002 to help you choose and implement controls.
Both are edition 3: 27001 in October 2022, 27002 in February 2022. ISO's own page for 27002 says organizations seek certification to ISO/IEC 27001, which references 27002 for guidance.
Side by side
| Topic | ISO/IEC 27001:2022 | ISO/IEC 27002:2022 |
|---|---|---|
| What it is | Requirements for an information security management system | Guidance on information security controls |
| Certifiable | Yes | No |
| Edition | Edition 3, October 2022 | Edition 3, February 2022 |
| Length in ISO's catalogue | 19 pages | 152 pages |
| Used for | Running the management system and passing the audit | Choosing, implementing and describing controls |
How they work together
Your risk assessment decides which controls apply. 27001 asks you to consider them and record your decisions, and 27002 explains what each control is for and how it can be implemented. A certification audit checks against 27001, not against 27002. For the risk side, there is also PECB ISO/IEC 27005 Risk Manager.
From my side of the table. Use 27002 to write control descriptions in your own words. Copying its text into your policies rarely shows that the control works.
Ways to learn with reconn
I teach these courses myself as a PECB Certified Trainer, with more than 20 years in cybersecurity. I am a practitioner, not a slide reader.
Want more structure? The eLearning+, Live Online Sprint, Live Online and Classroom packages add live teaching and extra benefits. Live Online Lead Auditor is planned from 2027, and you can contact me now to register interest.
Which PECB course fits your role?
Lead Implementer
Plan, build and run an ISMS to ISO/IEC 27001.
For people who build and run the ISMS.
Lead Auditor
Plan, run and report an ISMS audit.
For people who audit it.
Lead Implementer and Lead Auditor bundle
Both Lead courses together, in English.
For people who build the system and are also expected to check it.
Live Online Lead Implementer
Instructor-led and taught live by me.
For people who want a trainer and a fixed schedule.
Chief Information Security Officer
Lead the information security program across the organization.
For people moving from running an ISMS to leading security.
Frequently asked questions
What is the difference between ISO 27001 and ISO 27002?
ISO/IEC 27001 sets the requirements for an ISMS and can be certified. ISO/IEC 27002 gives guidance on information security controls and cannot be certified.
Can I be certified to ISO 27002?
No. Organizations seek certification to ISO/IEC 27001, which references 27002 for guidance.
Which one does an auditor check against?
A certification audit checks against ISO/IEC 27001, not against 27002.
Do I need both?
In practice yes. You use 27001 to run the management system and 27002 to help you choose and describe controls.