ISO 27001 vs ISO 27002: Requirements, Guidance and Evidence

ISO/IEC 27001 and ISO/IEC 27002 are designed to work together, but they do different jobs. ISO 27001 specifies requirements for an information security management system. ISO 27002 provides detailed guidance for information-security controls.

An organisation can be certified against ISO 27001 within a defined scope. ISO’s official ISO 27002 overview states that ISO 27002 provides recommendations and does not itself lead to certification.

The short comparison

Question	ISO/IEC 27001:2022	ISO/IEC 27002:2022
Primary purpose	Define ISMS requirements	Guide control design and implementation
Content	Clauses 4–10 plus Annex A reference controls	Detailed control purpose, guidance and related information
Certification	Organisations may seek accredited certification	Not a certifiable requirements standard
Use	Establish, operate, evaluate and improve the ISMS	Support selection, design and improvement of controls
Audit role	Source of conformity criteria for ISO 27001 certification	Useful guidance and evidence context, not independent certification criteria unless adopted as a requirement

The official ISO 27001 page describes the requirements standard’s focus on managing risks to confidentiality, integrity and availability.

ISO 27001 governs the system

The main requirements address:

• organisational context and interested parties;
• ISMS scope;
• leadership, policy and responsibilities;
• risk and opportunity planning;
• information-security risk assessment and treatment;
• objectives and planning;
• resources, competence, awareness and communication;
• documented information;
• operational control;
• monitoring, measurement and evaluation;
• internal audit and management review; and
• nonconformity, corrective action and continual improvement.

This is why an organisation cannot achieve meaningful conformity by implementing technical controls alone. It needs a management system that decides what matters, assigns ownership, evaluates results and improves.

The clauses 4–10 guide explains how the clauses form one operating cycle.

Annex A is a reference set, not the whole standard

Annex A in ISO 27001:2022 contains 93 controls organised into organisational, people, physical and technological themes. During risk treatment, the organisation determines necessary controls, compares them with Annex A and maintains a Statement of Applicability.

It is incorrect to treat all 93 as automatically mandatory. A control may be necessary because of assessed risk or legal, regulatory or contractual requirements. A control may be excluded when it is not necessary, provided the decision is justified and does not undermine applicable requirements.

It is also incorrect to assume that controls outside Annex A are prohibited. The organisation may design additional or different controls when needed.

The Annex A selection guide gives a practical route from risk to control rationale and evidence.

ISO 27002 expands the control conversation

ISO 27002 helps practitioners understand control purpose, implementation considerations and related concepts. It can improve consistency and expose gaps that a short control title would not reveal.

Use it to ask:

• What outcome should the control produce?
• Which people, process and technology elements matter?
• What implementation boundaries or dependencies exist?
• Which attributes help classify or view the control?
• What evidence could demonstrate operation?
• Which related controls should be coordinated?

Do not copy guidance without tailoring. A multinational cloud provider and a small professional firm may pursue the same control outcome through different measures.

How the two standards connect

A defensible sequence is:

1. understand context and interested-party requirements;
2. define the ISMS scope;
3. assess information-security risks;
4. decide treatment;
5. determine necessary controls;
6. compare with Annex A;
7. use ISO 27002 and other sources to inform design;
8. document applicability and rationale;
9. implement and operate controls;
10. measure effectiveness; and
11. improve through audit, review and corrective action.

This sequence prevents the common reversal of starting with a control catalogue and inventing risks afterward.

Use the Statement of Applicability rationale guide to keep risk, treatment and control decisions aligned.

What an auditor should test

For ISO 27001 conformity, auditors test requirements and the organisation’s own commitments. ISO 27002 can inform professional understanding, but guidance is not automatically a mandatory criterion.

For a sampled control, ask:

• Which risk or requirement made this control necessary?
• Is the Statement of Applicability consistent with treatment?
• What outcome and boundary were approved?
• Who owns the control?
• Does implementation match design?
• What records demonstrate operation across the period?
• How is effectiveness measured?
• What exceptions exist?
• Were weaknesses corrected?

An audit finding should identify the unmet requirement or commitment and objective evidence. “The organisation did not follow every ISO 27002 suggestion” is not, by itself, a valid ISO 27001 nonconformity.

Evidence across four layers

Management-system evidence

Scope, context, risk method, risk results, treatment, objectives, competence, internal audit, management review and corrective action demonstrate how the ISMS is governed.

Control design evidence

Policies, standards, responsibility models, architecture, procedures and acceptance criteria show intended operation.

Implementation evidence

Configurations, workflows, deployed safeguards, assigned roles and integrations show that design exists in the relevant environment.

Operating evidence

Tickets, reviews, logs, alerts, test results, incidents, approvals and remediation show performance through time.

ISO 27001 requires the system to work; ISO 27002 helps teams think more deeply about controls. Neither is satisfied by copying documentation without operating proof.

The implementation-versus-operating-evidence guide explains this distinction in depth.

Common implementation choices

Organisation seeking certification

Use ISO 27001 as the requirements baseline. Use ISO 27002 to design selected controls and prepare meaningful evidence. Define any additional contractual frameworks separately.

Organisation improving security without certification

ISO 27002 can inform a control programme, but risk governance, ownership and evaluation remain necessary. Using guidance does not allow the organisation to claim ISO 27001 certification.

Customer reviewing a supplier

Ask for the ISO 27001 certificate, scope, status and relevant assurance. Do not accept a statement of “ISO 27002 compliance” as equivalent certification. Verify which service, entity and period the evidence covers.

Internal auditor

Audit ISO 27001 requirements, applicable controls and internal commitments. Use ISO 27002 to sharpen questions while keeping findings tied to valid criteria.

Sampling controls

Select controls based on risk, change, prior findings, incidents, complexity and dependency. Include organisational, people, physical and technological examples rather than sampling only IT settings.

For each sample, trace:

1. risk or requirement;
2. applicability decision;
3. design informed by appropriate guidance;
4. implementation in scope;
5. operating records;
6. effectiveness evaluation; and
7. action on weaknesses.

Use the Annex A control lookup to navigate control themes, while using licensed standards for authoritative content.

Pass, partial and fail examples

Pass: The organisation operates an ISO 27001 management system, selects controls from risk and obligations, uses ISO 27002 to inform proportionate design, and retains evidence of operation and improvement.

Partial: Risk and applicability are documented, but control design mostly repeats titles. Implementation exists, while effectiveness criteria and period evidence are inconsistent.

Fail: A team declares conformity because all 93 controls appear in a spreadsheet. It cannot demonstrate scope, risk treatment, internal audit, management review or control operation.

These examples illustrate evidence maturity, not mandatory audit grades.

Common misunderstandings

Avoid:

• calling ISO 27002 a certifiable ISMS standard;
• treating Annex A as the entire ISO 27001 standard;
• assuming every Annex A control is mandatory;
• excluding controls without considering obligations;
• copying ISO 27002 guidance without risk tailoring;
• using control documentation as proof of operation;
• writing findings against optional guidance alone; and
• claiming a supplier’s certificate covers every product.

Run the ISO 27001 readiness checker to identify management-system gaps beyond the control catalogue.

Practical conclusion

ISO 27001 tells an organisation what a conforming ISMS must achieve. ISO 27002 helps it understand and implement information-security controls. Use ISO 27001 to govern scope, risk, evaluation and improvement; use ISO 27002 to strengthen control design.

The two standards are complementary, but their roles should remain clear in certification claims, audit criteria and evidence.