ISO 27000 Family: Which Standards Support Your ISMS?

The ISO/IEC 27000 family is not one large certification scheme. It is a changing family of requirements, guidance and specialist standards for information security, cybersecurity and privacy. Each document has a defined purpose; buying or citing several of them does not automatically strengthen an ISMS.

For most organisations, ISO/IEC 27001 is the management-system anchor. Other family members help with vocabulary, controls, risk, measurement, cloud security, privacy or ICT readiness. The practical task is to choose only the guidance that supports a real decision or control need.

Direct answer: Use ISO 27001 for ISMS requirements, then add supporting family standards according to risk, technology, sector and assurance needs. Record why each standard is relevant, which edition applies, how guidance is used and who owns resulting actions.

Requirements and guidance are different

ISO/IEC 27001:2022 contains requirements for establishing, implementing, maintaining and continually improving an ISMS. An organisation can seek independent certification of the defined ISMS scope against those requirements.

Supporting standards generally provide guidance or specialist practices. They can improve implementation, but they do not silently add requirements to ISO 27001. A certification auditor may examine how the organisation achieved its chosen controls and objectives, yet should not present optional guidance as mandatory ISO 27001 text.

ISO’s official ISO 27000 family page is the best starting point for current family information. Always confirm status and edition in the official catalogue because standards are revised, replaced or withdrawn.

A practical map of frequently used standards

Standard	Primary purpose	Use it when
ISO/IEC 27001	ISMS requirements	Establishing or independently certifying an ISMS
ISO/IEC 27002	Information-security control guidance	Designing or improving controls selected through risk treatment
ISO/IEC 27005	Information-security risk guidance	Strengthening risk identification, assessment, treatment and monitoring
ISO/IEC 27004	ISMS monitoring and measurement guidance	Defining trustworthy measures and evaluating effectiveness
ISO/IEC 27017	Cloud security control guidance	Clarifying cloud-specific control design and shared responsibilities
ISO/IEC 27018	Protection of personal information in public cloud processing	Addressing public-cloud privacy control needs
ISO/IEC 27031	ICT readiness for business continuity	Designing and testing recovery capability for critical ICT services
ISO/IEC 27701	Privacy information management requirements and guidance	Establishing privacy governance alone or alongside an ISMS

This is a decision map, not an exhaustive catalogue. Sector, telecom, network security, incident investigation and supplier-relationship publications also exist. Their relevance depends on the organisation’s context.

ISO 27001: the management-system anchor

ISO 27001 connects context, leadership, planning, support, operation, performance evaluation and improvement. It requires organisations to assess information-security risk, plan treatment, compare selected controls with Annex A and maintain a Statement of Applicability.

Annex A is a reference set. It is not a direction to implement every control identically. The organisation must consider necessary controls from any source and justify its applicability decisions.

The management-system clauses provide the governing structure. The free ISO 27001 Clause Explainer provides practical implementation and evidence prompts.

ISO 27002: control design guidance

ISO/IEC 27002:2022 provides guidance for information-security controls. It aligns with the 93 controls referenced by ISO 27001:2022 Annex A and adds implementation considerations and attributes.

Use it to understand intent, explore implementation approaches and improve evidence expectations. Do not copy its text into policy or claim that every example is compulsory. Tailor control design to risk, legal obligations, architecture, culture and operating capacity.

The ISO 27001 and ISO 27002 comparison shows how requirements and guidance differ. The free Annex A Control Lookup offers a browser-based view of implementation context and audit questions.

ISO 27005: risk-management guidance

ISO/IEC 27005:2022 supports the information-security risk process behind an ISMS. ISO’s official ISO 27005 overview describes a full cycle of assessment, treatment, communication, monitoring and review.

Use it when the organisation needs to improve scenarios, criteria, stakeholder communication, treatment decisions or continuing review. It does not require one scoring scale or make a generic risk catalogue sufficient.

The organisation’s method must remain repeatable and produce comparable results. The ISO 27001 risk-assessment guide explains the evidence an auditor can test.

Specialist guidance should solve a defined problem

Choose a specialist standard only after describing the need.

Cloud services

ISO 27017 can help clarify cloud-provider and cloud-customer responsibilities, virtualised environments and cloud-specific implementation. ISO 27018 addresses protection of personally identifiable information where a public cloud provider acts in the relevant processing role.

Neither publication replaces contracts, architecture analysis, applicable privacy law or supplier assurance. Use the ISO 27017 cloud-control comparison to decide whether cloud guidance adds value.

Measurement

ISO 27004 supports monitoring, measurement, analysis and evaluation. It is useful when dashboards contain ambiguous populations, activity counts or targets that trigger no action.

ICT continuity

ISO 27031 provides guidance on ICT readiness for business continuity. It helps translate continuity requirements into dependencies, recovery strategies and exercises. It complements rather than replaces enterprise business continuity arrangements.

Privacy

ISO/IEC 27701:2025 is now a standalone privacy information management system standard that can also integrate with ISO 27001. The ISO 27001, 27002 and 27701 relationship guide explains this current structure.

Create a standards applicability record

Maintain a small controlled record for the external standards the organisation uses. Include:

• exact reference and edition;
• status and date last verified;
• reason for use;
• affected scope, process or control;
• accountable owner;
• licensed access location;
• implementation decisions;
• related internal documents and evidence;
• transition or review date; and
• standards no longer used, with rationale.

This is not the ISO 27001 Statement of Applicability. It is a practical governance record that prevents teams from citing withdrawn editions or treating purchased guidance as implemented practice.

Evaluate a new standard before adopting it

Ask five questions:

1. Which risk, obligation or operating problem will it address?
2. Does existing guidance already cover the need?
3. Is it requirements, guidance, a technical report or another publication type?
4. What processes, competence and evidence would change?
5. Who will maintain alignment when the publication changes?

Run a focused gap assessment. Map relevant guidance to existing processes, identify genuinely useful changes and reject additions that create administration without improving outcomes.

Audit the use of supporting standards

An auditor should not merely confirm that a standard appears in a policy. Sample a claimed use and trace it into operation.

For example, if the organisation cites ISO 27017 for cloud security, inspect shared-responsibility decisions, cloud configuration, supplier evidence, exceptions and review results. If it cites ISO 27004, inspect measure definitions, data quality, thresholds and management action.

Pass: References are current, purpose is clear, guidance has been translated into owned practice, and operating evidence supports the claim.

Partial: The right publications are identified, but edition control, scope or implementation traceability is inconsistent.

Fail: Withdrawn editions drive the programme, guidance is presented as mandatory without analysis, or standards are cited for marketing while related controls do not operate.

Use the family deliberately

The family is most valuable when it reduces uncertainty about a real implementation decision. Start with ISO 27001 requirements and the organisation’s own risks. Add control, risk, measurement, cloud, privacy or continuity guidance only where it improves the system.

That approach keeps the ISMS coherent, prevents standards accumulation and gives auditors a clear path from external guidance to internal decision and operating evidence.