ISO 27001, ISO 27002 and ISO 27701: How the Standards Fit Together

ISO/IEC 27001, ISO/IEC 27002 and ISO/IEC 27701 address connected but different management questions. Confusion usually arises when teams treat all three as equivalent control catalogues or assume that one certification proves every security and privacy obligation.

ISO/IEC 27001 contains requirements for an information security management system. ISO/IEC 27002 provides information-security control guidance. ISO/IEC 27701:2025 contains requirements and guidance for a privacy information management system and can now be used as an independent management system standard.

The relationship is best understood by deciding which system you need to govern, which guidance helps design controls and which evidence demonstrates operation.

ISO/IEC 27001: the ISMS requirements

ISO/IEC 27001:2022 defines requirements for establishing, implementing, maintaining and continually improving an ISMS. Its clauses address organisational context, leadership, planning, support, operation, performance evaluation and improvement.

Annex A provides a reference set of information-security controls. The organisation does not automatically implement every control. It identifies risks and requirements, decides treatment, compares selected controls with Annex A and documents applicability in the Statement of Applicability.

Certification bodies can assess an ISMS against ISO 27001. ISO itself does not certify organisations; independent certification bodies provide that assurance. The official ISO 27001 overview describes the standard’s purpose and current edition.

Use ISO 27001 when the organisation needs a governed, risk-based system for confidentiality, integrity and availability rather than a disconnected set of technical measures.

ISO/IEC 27002: control guidance

ISO/IEC 27002:2022 explains information-security controls and implementation considerations. It helps practitioners understand intent, attributes and possible approaches. It is guidance rather than a separate set of ISMS certification requirements.

Its control structure aligns with the 93 controls referenced in ISO 27001:2022 Annex A across organisational, people, physical and technological themes.

Use ISO 27002 to:

• interpret a control’s purpose;
• consider implementation options;
• identify related evidence;
• adapt measures to risk and context; and
• improve controls selected through the ISMS.

Do not copy guidance as policy or assume every example is mandatory. A control should be designed for the organisation’s technology, threat exposure, legal duties and operating model.

The official ISO 27002 overview describes it as guidance for organisations seeking to establish, implement and improve information-security controls.

ISO/IEC 27701:2025: the PIMS requirements

ISO/IEC 27701:2025 is the current privacy information management system standard. Unlike the withdrawn 2019 edition, which was structured as an extension to ISO 27001 and ISO 27002, the 2025 edition is an independent management system standard. ISO’s official ISO 27701 page confirms that it can be used alone.

A PIMS provides governance for personally identifiable information, privacy risk and the responsibilities of organisations acting in relevant processing roles. It can be integrated with an ISMS, but privacy management is not limited to information security.

Use ISO 27701 when the organisation needs a systematic approach to privacy accountability, risk, objectives, operating controls, performance evaluation and improvement. It can support legal compliance, but certification does not replace analysis of GDPR, CCPA or other applicable law.

Compare their roles

Standard	Primary role	Typical use	Assurance point
ISO 27001	ISMS requirements	Govern information-security risks	ISMS can be independently certified
ISO 27002	Security control guidance	Design and improve controls	Used as guidance, not a standalone certification basis
ISO 27701:2025	PIMS requirements and guidance	Govern privacy information management	Standalone or integrated PIMS certification is possible

The standards can share governance while preserving different objectives. A management review may cover both systems, but security metrics and privacy outcomes should remain distinguishable.

Choose a deployment model

ISO 27001 with ISO 27002 guidance

This is appropriate when the priority is an ISMS. Use ISO 27002 to develop the controls chosen through risk treatment. Privacy obligations can be treated as interested-party requirements, but a complete privacy management system is not created automatically.

Standalone ISO 27701

The 2025 edition allows an organisation to build a PIMS without first certifying an ISMS. This can suit a privacy-focused organisation or a scope where privacy governance is the primary objective.

Security still matters because personal information must be protected. The PIMS should connect to whatever security governance supports its privacy outcomes.

Integrated ISMS and PIMS

Integration can reuse context analysis, leadership arrangements, documented-information controls, competence, internal audit, management review and corrective action. It can also share asset, supplier, incident and risk evidence.

Do not force one risk register to hide different impact perspectives. Information-security risk considers organisational objectives and information properties. Privacy risk also considers consequences for individuals. Related risks can be linked while retaining the analysis each system needs.

Prevent common design errors

Treating ISO 27002 as mandatory in full

Annex A is a reference set within ISO 27001, and ISO 27002 is guidance. Applicability follows risk treatment and requirements. Auditors should expect reasoned decisions, not automatic adoption of every implementation example.

Treating security as all of privacy

Access control, encryption, logging and incident response support privacy. They do not establish legal basis, transparent notices, individual rights, purpose limitation or international-transfer decisions.

The ISO 27001 and GDPR coverage guide illustrates this boundary.

Using the withdrawn ISO 27701 structure without transition

Organisations using the 2019 edition should evaluate the 2025 requirements, changed structure, scope implications and certification transition arrangements. Update cross-references, audit criteria and competence rather than simply changing the year on documents.

Combining evidence without ownership

One record may support multiple standards, but it still needs an owner, purpose, retention rule and accessible source. Duplicated evidence drifts; over-combined evidence becomes unreadable.

Create an integrated evidence architecture

Group evidence by business workflow:

• governance: scope, interested parties, roles, objectives and management decisions;
• risk: security and privacy assessments with linked treatment;
• information: inventory, classification, processing and retention;
• people: competence, responsibilities and awareness;
• suppliers: due diligence, agreements, monitoring and change;
• operations: access, deletion, logging, transfer and resilience;
• incidents: detection, assessment, response and notification decisions; and
• assurance: measures, internal audits, findings and improvement.

Add a field showing which requirement or control each record supports. Avoid copying licensed standard text into systems. Use authorised references and concise internal interpretations.

The Annex A documentation guide explains how to organise security-control evidence without creating one document per control.

Map standards without false equivalence

Use relationship types rather than claiming exact one-to-one matches:

• shared management-system mechanism;
• security control supporting a privacy requirement;
• privacy requirement requiring additional process;
• related but differently scoped evidence; and
• no meaningful relationship.

For example, access control may support both information security and protection of personal information. A data-subject request process, however, contains legal identity verification, scope, exceptions and communication steps that a security access-control process does not provide.

The free Annex A control lookup can identify relevant ISO 27001 controls. Privacy requirements should be checked against ISO 27701 and applicable law separately.

Audit an integrated system

Plan audits around processes and risk while preserving each standard’s criteria. A supplier sample can test ISMS security requirements, PIMS processing responsibilities and common contract governance in one trail.

Ask:

• Are the ISMS and PIMS scopes explicit and compatible?
• Which edition of each standard is the audit criterion?
• Are security and privacy risk impacts distinguished?
• Does the Statement of Applicability reflect the ISMS decisions?
• Are privacy roles and processing responsibilities clear?
• Which evidence is shared, and who owns it?
• Are legal obligations validated outside the standards mapping?
• Can management see separate security and privacy outcomes?

Use the free ISO 27001 readiness checker for an initial ISMS view. It does not assess all ISO 27701 requirements or privacy-law duties.

Interpret assurance correctly

A strong integrated system shows clear scopes, current editions, traceable risk decisions, shared governance, distinct privacy requirements and operating evidence. A partial result may show effective ISO 27001 controls but an immature PIMS or outdated ISO 27701 mapping. A fail would be claiming privacy compliance solely from ISO 27001 certification or treating ISO 27002 as a certifiable management system.

The three standards work well together when each retains its proper role. ISO 27001 governs the ISMS, ISO 27002 helps design information-security controls, and ISO 27701:2025 governs the PIMS independently or alongside the ISMS. Integration should reduce duplicated work while making security and privacy accountability clearer, not blur their boundaries.