ISO 27001 vs ISO 27002: What's the Difference?

ISO/IEC 27001 defines the requirements for an Information Security Management System (ISMS) — the clauses you implement and the standard certification bodies audit against. ISO/IEC 27002 is control guidance: how to design and operate security controls. You do not get a 27002 certificate; you use 27002 to implement the Annex A–aligned control set referenced by 27001.

One-line rule: Certify to 27001 (management-system requirements). Use 27002 as the control playbook that informs your Statement of Applicability and control design.

ISO 27001 vs ISO 27002 at a Glance

Aspect

ISO/IEC 27001

ISO/IEC 27002

Document type

Requirements standard (MSS)

Code of practice / control guidance

Certifiable?

Yes — IAF-accredited certification bodies

No — not a certification target

Primary focus

ISMS clauses: context, leadership, planning, support, operation, performance, improvement

Control objectives and implementation guidance

Annex A relationship

Annex A control set aligned to ISO/IEC 27002:2022

Detailed guidance for those controls

Typical buyer use

External assurance, contracts, regulatory mapping

Control design, SoA justification, auditor dialogue

What ISO 27001 Actually Requires

ISO 27001 is a management-system standard. Certification depends on whether your ISMS meets the normative clauses — scope, risk assessment and treatment, leadership commitment, documented information, internal audit, management review, and continual improvement — not on memorising every control title in isolation.

Annex A provides a reference set of information security controls. Your Statement of Applicability (SoA) must justify which controls apply, which are excluded, and how residual risk is treated. That Annex A set is aligned to ISO/IEC 27002:2022 guidance.

What ISO 27002 Is For

ISO 27002 does not replace your ISMS. It explains control intent and common implementation approaches so security, IT, and compliance teams can design proportionate controls. Auditors still assess conformity to ISO 27001; 27002 helps you interpret and evidence the Annex A–aligned controls you claim.

Common mistake: Buying a “27002 checklist tool” and skipping ISMS clauses (risk methodology, internal audit, management review). That path fails Stage 1/Stage 2 even if many technical controls look strong.

Practical Implementation Order

Define ISMS scope and interested parties (27001 clauses).
Run risk assessment and treatment — then draft the SoA.
Use 27002 guidance to design applicable Annex A–aligned controls.
Operate, measure, internally audit, and review before Stage 2.

How CyberSilo Helps

CSA for ISO 27001 — SoA, clause evidence, and Annex A–aligned control tracking
ThreatHawk SIEM — operational monitoring evidence for logging and detection controls
Readiness support for Stage 1/Stage 2 — not a substitute for the certification body

Build an ISMS You Can Actually Certify

Map 27001 clauses and Annex A–aligned controls to continuous evidence — without confusing guidance documents with certification requirements.

Talk to CyberSilo ISO 27001 Automation

Frequently Asked Questions

Can you get certified to ISO 27002?

No. ISO/IEC 27002 is a code of practice for information security controls. Certification audits are performed against ISO/IEC 27001 (the ISMS requirements standard).

Do I need both ISO 27001 and ISO 27002?

You certify to ISO 27001. Most programs use ISO 27002 as implementation guidance when selecting and designing Annex A–aligned controls and documenting the Statement of Applicability.

How does Annex A relate to ISO 27002?

ISO/IEC 27001 Annex A presents a control set that is aligned to ISO/IEC 27002:2022 guidance. Auditors assess your ISMS against 27001 clauses and the justified applicability of Annex A controls — not against a separate 27002 certificate.

What is ISO 27001 · ISO 27001 hub · Annex A reference · Internal audit guide · CSA for ISO 27001 · SOC 2 vs ISO 27001

ISO 27001 vs ISO 27002: What's the Difference?

ISO 27001 vs ISO 27002 at a Glance

What ISO 27001 Actually Requires

What ISO 27002 Is For

Practical Implementation Order