If you’ve started researching information security standards, you’ve likely hit the same wall every IT manager and compliance officer hits: the ISO 27001 vs ISO 27002 question. Both numbers get thrown around in the same breath, often as if they’re interchangeable. They’re not, and mixing them up can cost you time and money during an audit or certification project.
Here’s the short answer: ISO 27001 is the certifiable standard, the framework your organisation is actually assessed and certified against. ISO 27002 is a supporting reference, a detailed guidance document that explains how to implement the security controls listed in ISO 27001’s Annex A. One sets the requirements; the other tells you how to meet them in practice.
In this article, we’ll break down what each standard actually covers, how they work together in a real ISO 27001 implementation, and where businesses commonly get confused between the two. Having supported organisations through certification for over 30 years, we’ll also share the practical distinctions that matter most once you’re building your Information Security Management System.
Why the difference between ISO 27001 and ISO 27002 matters
Getting this wrong isn’t just a technicality. Businesses regularly tell us they’ve been "doing ISO 27002" when what they actually need is ISO 27001 certification to win a tender or satisfy a client’s procurement team. ISO 27002 has no certification scheme attached to it at all. You cannot be audited against it, and no certification body will ever issue you an ISO 27002 certificate. If a supplier questionnaire or contract asks whether you’re "ISO 27001 certified," pointing to ISO 27002 work simply won’t satisfy the requirement, no matter how thorough that work has been.
ISO 27001 is what you get certified against; ISO 27002 is what helps you get there.
Certification hinges on ISO 27001, not ISO 27002
ISO 27001 is the management system standard. It sets out mandatory requirements for establishing, running, monitoring, and improving an Information Security Management System (ISMS), covering things like leadership commitment, risk assessment, internal audits, and management review. Clauses 4 through 10 of the standard are the parts an external auditor checks against, and Annex A lists 93 security controls (in the 2022 revision) that organisations must consider and justify including or excluding via a Statement of Applicability, which is worth reading up on if you want the full picture of what the ISO 27001 scope, ISMS and controls include. Miss this distinction and you risk building a security programme that looks impressive on paper but doesn’t map to anything a certification body will actually recognise.
ISO 27002 exists to make Annex A workable
ISO 27002, by contrast, is a code of practice. It takes each of the 93 Annex A controls and their categories and expands on them, explaining implementation guidance, purpose, and other information for every single one. Without ISO 27002, Annex A is little more than a list of control titles like "access control" or "cryptography." With it, you get practical detail on how those controls might actually be applied in a real environment. Think of ISO 27001 as the exam syllabus and ISO 27002 as the textbook that explains each topic on that syllabus in depth.
The confusion has real business consequences
Misunderstanding the ISO 27001 vs ISO 27002 standard relationship shows up in a few predictable ways across the businesses we work with:
- Wasted budget: paying for extensive ISO 27002 consultancy while assuming it delivers a certifiable outcome.
- Failed audits: submitting Annex A justifications that read like ISO 27002 guidance copied verbatim, rather than evidence tailored to the organisation’s actual risk context.
- Confused stakeholders: sales and compliance teams telling clients they’re "ISO 27002 compliant," a phrase that has no formal meaning and can undermine credibility with security-conscious customers.
- Delayed certification timelines: discovering the gap between guidance and requirement only once a certification body is already scheduled to visit, rather than while you still have time to prepare for the stages of an ISO 27001 audit.
Understanding the split early saves you from these headaches later, and it shapes how you should scope any ISO 27001 and 27002 project from day one.
How ISO 27001 and ISO 27002 work together in practice
Once you understand that ISO 27001 sets requirements and ISO 27002 explains how to meet them, the practical workflow becomes obvious. You start with ISO 27001’s risk assessment process, one of the core ISO 27001 implementation steps, to identify which of the 93 Annex A controls are relevant to your organisation. Then, for each control you select, you turn to ISO 27002 to understand what a well-implemented version of that control actually looks like before you write your policies and procedures.
Building the Statement of Applicability
The Statement of Applicability (SoA) is where this handoff happens most visibly. ISO 27001 requires you to produce an SoA that justifies including or excluding each Annex A control based on your risk assessment. ISO 27002 doesn’t dictate what goes in your SoA, but its detailed control descriptions give you the language and context to justify those decisions properly, rather than guessing at what
Key differences between ISO 27001 and ISO 27002 at a glance
Sometimes the fastest way to cut through the confusion is a straight comparison. Below is how the two standards stack up against each other once you strip away the jargon and look at what each one actually does, requires, and produces for your organisation.
ISO 27001 tells an auditor what to check; ISO 27002 tells your team what to build.
Side-by-side comparison
| Aspect | ISO 27001 | ISO 27002 |
|---|---|---|
| Type of document | Management system requirements standard | Code of practice, guidance only |
| Certifiable? | Yes, organisations are audited and certified against it | No, there is no certification scheme |
| Core content | ISMS clauses (4-10) plus Annex A control list | Detailed guidance for every Annex A control |
| Who uses it | Auditors, certification bodies, senior management | Implementers, IT teams, policy writers |
| Output | Certificate of compliance, Statement of Applicability | Implementation guidance, control descriptions |
| Mandatory for certification? | Yes | No, but practically essential for building evidence |
Understanding this table matters more than memorising it, because it shows the two documents were never designed to compete with each other. ISO 27001 vs ISO 27002 isn’t really a rivalry between two approaches to security. It’s a division of labour between a standard that sets the bar and a companion document that explains how to clear it.
What this means for your documentation
Documentation is where the split becomes most concrete. Your ISMS documentation built to satisfy ISO 27001, policies, risk registers, internal audit records, needs to reference specific clauses of the standard, so it helps to know which records ISO 27001 actually demands. Your control implementation guides, on the other hand, will lean heavily on ISO 27002 wording when describing how you’ve configured access controls, encryption standards, or supplier security requirements. Keeping that distinction clear in your document set makes life considerably easier when an auditor asks you to trace a control back to its justification.
Which standard does your organisation need first?
Most businesses don’t actually need to choose between the two, because they need both, but they should start reading in a specific order. If certification is the goal, whether that’s to win a tender, satisfy a client’s due diligence questionnaire, or reassure insurers after a breach, ISO 27001 is where you begin. It defines where your ISMS boundaries sit, the risk assessment methodology, and the management commitments an auditor will check first. Reading ISO 27002 before you’ve scoped your ISMS against ISO 27001 tends to produce generic control documentation that doesn’t map to your actual risk profile.
Start with ISO 27001 to define the scope, then bring in ISO 27002 to fill in the detail.
Signs you need ISO 27001 first
Organisations under pressure from external stakeholders almost always need to start with the requirements standard rather than the guidance document. Ask yourself which of these applies to your situation:
- A client, insurer, or supply chain partner has explicitly asked for ISO 27001 certification, and you need to know how to achieve ISO 27001 certification step by step.
- You need a formal, auditable framework to present to a board or regulator.
- You’re bidding for contracts where certification is a stated requirement.
- You want a Statement of Applicability that a certification body will actually accept.
Signs ISO 27002 guidance can wait or run in parallel
Smaller organisations without an immediate certification deadline sometimes benefit from working through ISO 27002 concepts informally while their ISMS documentation is still taking shape. That approach works fine as a maturity-building exercise, but it shouldn’t be mistaken for progress toward certification, since ISO 27002 alone produces no certifiable outcome.
Speaking practically, we rarely see successful projects that treat this as an either/or decision. The organisations that move fastest through certification typically bring in expertise early, scope the ISMS against ISO 27001, and lean on ISO 27002 guidance as they build out each control. If you’re unsure where your organisation currently sits, an ISO 27001 gap analysis with a practical remediation roadmap can assess your starting point and map out which standard needs your attention first, and when.
Making sense of ISO 27001 and ISO 27002
Boiled down, the ISO 27001 vs ISO 27002 question isn’t really a contest at all. ISO 27001 gives you the certifiable framework, the clauses, the risk assessment process, and the Annex A controls an auditor checks. ISO 27002 gives you the practical detail behind each of those controls, so your policies and procedures hold up under scrutiny rather than reading as guesswork. Neither standard replaces the other, and treating them as competing options only slows your certification project down.
Getting this right from the start, scoping against ISO 27001 first and using ISO 27002 to flesh out implementation, saves you rework, wasted budget, and awkward conversations with certification bodies later. If you’re still working out where your organisation stands or what a realistic certification timeline looks like, our ISO 27001 consultancy support will help you map the path from wherever you’re starting.
