Services
Services
SOC & Attestations
SOC & Attestations
Payment Card Assessments
Payment Card Assessments
ISO Certifications
ISO Certifications
Privacy Assessments
Privacy Assessments
Federal Assessments
Federal Assessments
Healthcare Assessments
Healthcare Assessments
Penetration Testing
Penetration Testing
Cybersecurity Assessments
Cybersecurity Assessments
Crypto and Digital Trust
Crypto and Digital Trust
Schellman Training
Schellman Training
ESG & Sustainability
ESG & Sustainability
Industry Solutions
Industry Solutions
Cloud Computing & Data Centers
Cloud Computing & Data Centers
Financial Services & Fintech
Financial Services & Fintech
Healthcare
Healthcare
Payment Card Processing
Payment Card Processing
US Government
US Government
Higher Education & Research Laboratories
Higher Education & Research Laboratories
About Us
About Us
Leadership Team
Leadership Team
Careers
Careers
Corporate Social Responsibility
Corporate Social Responsibility
Strategic Partnerships
Strategic Partnerships

The Relationship Between ISO 27001 and 27002

ISO Certifications

So what's the relationship between ISO 27001 and ISO 27002?

They're often used interchangeably, which can lead to confusion about their intended uses. In the video above, I provide a high-level overview of the differences and relationships between these two standards.

What is ISO 27001?

ISO 27001 is a management system standard, which provides the requirements for establishing, implementing, maintaining, and continually improving what's referred to as an information security management system or an ISMS.

Now, what's an ISMS you might ask? It's a collection of people processes and technologies with the purpose of managing information security risk within an organization.

What is ISO 27002?

ISO 27001 is the standard that you get certified against. So where does that leave ISO 27002? Well, the intent of this standard is to be used as a reference for determining and implementing the controls to address and mitigate risks identified during your ISMS risk assessment process.

They are contained within annex A of ISO 27001, and will often comprise what's referred to as your statement of applicability or SOA, which is a tool utilized during a risk treatment or risk mitigation process based on their applicability to your unique environment and scope and the results of your risk assessment process.

You cannot get certified against ISO 27002. That is because it is guidance, not requirements like 27001. There are a lot of tools and supplemental information that facilitate key ISMS activities like the selection and implementation of controls and the overall risk mitigation activities.

In Summary

To sum up everything:

  • ISO 27001 is a management system standard, which you are certified against.
  • ISO 27002 are the controls and contain guidance, tools, and additional insights to assist you in your risk management process.
For more information, you can read additional articles on ISO 27002 and also more information from our team on ISO 27001.

About DANNY MANIMBO

Danny Manimbo is a Principal with Schellman based in Denver, Colorado. As a member of Schellman’s West Coast / Mountain region management team, Danny is primarily responsible for leading Schellman's AI and ISO practices as well as the development and oversight of Schellman's attestation services. Danny has been with Schellman for 10 years and has over 13 years of experience in providing data security audit and compliance services.