ISO 27001/ISO 22301 Knowledge base

Dejan Kosutic

ISO 27001 vs. ISO 27002

Author: Dejan Kosutic

If you came across both the ISO 27001 and the ISO 27002, you probably noticed that ISO 27002 is much more detailed, much more precise – so, what’s the purpose of ISO 27001 then?

First of all, you cannot get certified against ISO 27002 because it is not a management standard. What does a management standard mean? It means that such a standard defines how to run a system, and in case of ISO 27001, it defines the information security management system (ISMS) – therefore, certification against ISO 27001 is possible.

This management system means that information security must be planned, implemented, monitored, reviewed, and improved. It means that management has its distinct responsibilities, that objectives must be set, measured and reviewed, that internal audits must be carried out and so on. All those elements are defined in ISO 27001, but not in ISO 27002.

The differences between the controls in ISO 27002 and ISO 27001

The controls in ISO 27002 are named the same as in Annex A of ISO 27001 – for instance, in ISO 27002, control 6.1.2 is named “Segregation of duties,” while in ISO 27001 it is “A.6.1.2 Segregation of duties.” But, the difference is in the level of detail – on average, ISO 27002 explains one control on one whole page, while ISO 27001 dedicates only one sentence to each control.

Finally, the difference is that ISO 27002 does not make a distinction between controls applicable to a particular organization, and those which are not. On the other hand, ISO 27001 prescribes a risk assessment to be performed in order to identify for each control whether it is required to decrease the risks, and if it is, to which extent it should be applied.

The question is: why is it that those two standards exist separately, why haven’t they been merged, bringing together the positive sides of both standards? The answer is usability – if it was a single standard, it would be too complex and too large for practical use.

Which standard to use from the ISO 27000 series and when

Every standard from the ISO 27000 series is designed with a certain focus – if you want to build the foundations of information security in your organization, and devise its framework, you should use ISO 27001; if you want to implement controls, you should use ISO 27002, if you want to carry out risk assessment and risk treatment, you should use ISO 27005 etc.

To conclude, one could say that without the details provided in ISO 27002, controls defined in Annex A of ISO 27001 could not be implemented; however, without the management framework from ISO 27001, ISO 27002 would remain just an isolated effort of a few information security enthusiasts, with no acceptance from the top management and therefore with no real impact on the organization.

To learn the basics of ISO 27001, check this free ISO 27001 Foundations Online Course.

If you enjoyed this article, subscribe for updates

Improve your knowledge with our free resources on ISO 27001/ISO 22301 standards.

You may unsubscribe at any time.

For more information on what personal data we collect, why we need it, what we do with it, how long we keep it, and what are your rights, see this Privacy Notice.

2 responses to “ISO 27001 vs. ISO 27002”

  1. Philip Pountney says:

    Thanks for writing in a way that is both informative and easy to digest. Although, I’m a bit confused as I can not find the example you gave, “6.1.6 Contact with authorities”, I am finding that under 6.1.3 in both standards? I am missing something or perhaps is it a typo?
    Thanks again

    • Rhand Leal says:

      Sorry for this misunderstanding. The article was written when 2005 revisions of these standards were valid, when this control was numbered as A.6.1.6 (on ISO 27001) and 6.1.6 (on ISO 27002).

      We’ll update the article to reflect the new version of both standards.

      Thanks for the feedback.

Leave a Reply

Your email address will not be published. Required fields are marked *



  • Advisera is Exemplar Global Certified TPECS Provider for the IS, QM, EM, TL and AU Competency Units.
  • ITIL® is a registered trade mark of AXELOS Limited. Used under licence of AXELOS Limited. All rights reserved.
  • DNV GL Business Assurance is one of the leading providers of accredited management systems certification.