ISO 27001 · THE TWO STANDARDS
One of them you certify against. The other explains the controls. The expensive mistake is not confusing them, it is reading them in the wrong order.
TL;DR
ISO/IEC 27001 is the requirements standard, and the only one of the two you can certify against. ISO/IEC 27002 is guidance that explains how each control works. Clauses 4 to 10 of ISO 27001 hold the requirements an auditor checks. Annex A is a list of 93 controls you compare your own choices against. You do not work through it, and you do not work through ISO 27002 either.
Sources: ISO/IEC 27001:2022 · ISO/IEC 27002:2022
The difference in one line
ISO/IEC 27001 states what your information security management system must do. ISO/IEC 27002 explains how the controls work. A certification body audits you against 27001. Nobody audits you against 27002, because it holds no requirements.
That is the answer to the search, and it is the least useful thing on this page. The distinction most projects get wrong sits one level down.
Most teams read these two in the wrong order
Here is how a first ISO 27001 project often starts. Someone downloads ISO 27002 and finds 93 readable control write-ups. Each carries a purpose statement and guidance on how to build the control. The team treats that as the work list, and builds toward 93 controls.
The standard asks for the opposite direction. You determine your controls from your own risk treatment. Then you compare that set against Annex A to check you have missed nothing. Annex A is a cross-check. It is not a syllabus.
What trips people up
Clause 6.1.3 sets the order. You determine the controls your risk treatment needs. You compare them with Annex A to confirm nothing has slipped through. Then you write the Statement of Applicability. A team that starts from Annex A ends up with controls nobody can tie to a risk. An auditor will ask why they exist.
ISO 27002 sits one step further out. It is a reference you open after you have decided a control belongs in your system. You go there to learn how to build it. Opening it first turns a risk-driven project into a shopping list.
What good looks like
Risk assessment first. Risk treatment second. Annex A as the cross-check third. ISO 27002 fourth, one control at a time, only for the controls you already decided you need. Our four-step risk assessment guide covers the first two.
Inside ISO 27001
The requirements live in clauses 4 to 10. Every one of them carries the word “shall”, and every one of them shows up in an audit.
| Clause | Covers | What an auditor asks for |
|---|---|---|
| 4 | Context of the organization | Issues, interested parties, ISMS scope in writing |
| 5 | Leadership | Policy, assigned roles, evidence that management engages |
| 6 | Planning | Risk assessment, risk treatment, the Statement of Applicability, objectives |
| 7 | Support | Resources, competence, awareness, documented information control |
| 8 | Operation | The risk assessment and treatment running, not just written |
| 9 | Performance evaluation | Monitoring, internal audit, management review |
| 10 | Improvement | Nonconformities, corrective action, continual improvement |
Annex A comes after those clauses and holds 93 controls in four themes. Organizational controls, people controls, physical controls and technological controls. Each one gets a title and a single sentence. That brevity is deliberate, because the detail lives in the other standard.
What ISO 27002 holds, and why it exists
ISO 27002 takes each of those 93 controls and gives it a full write-up. A purpose statement, guidance on how to build it, and other notes worth having. Where Annex A gives you one line, ISO 27002 gives you a page.
It carries no clauses 4 to 10, no management system requirements and no “shall”. That is why no certificate against it exists, and why any firm claiming ISO 27002 certification has misunderstood both documents.
The two also share a numbering scheme, which is the point. Control 5.7 in Annex A is control 5.7 in ISO 27002. You look up the number and read the guidance.
What changed in 2022, and what changed after
The 2022 editions restructured Annex A rather than gutting it.
- 114 controls became 93. That reads like a cut of 21. It was not. 57 controls merged into 24, 58 stayed close to their old selves, and 11 arrived new.
- 14 domains became 4 themes. Organizational, people, physical and technological. A flatter shape that maps better onto how teams organise themselves.
- 11 new controls. Threat intelligence, cloud security, ICT readiness for business continuity, physical security monitoring and configuration management. Then information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.
- Five attributes per control. Control type, information security properties, cybersecurity concepts, operational capabilities and security domains. These help you slice the list. They are not extra requirements.
The amendment most articles have not caught up with
ISO published ISO/IEC 27001:2022/Amd 1:2024, “Climate action changes”, on 23 February 2024. It adds one sentence to clause 4.1.
“The organization shall determine whether climate change is a relevant issue.”
ISO/IEC 27001:2022/Amd 1:2024The full text of the clause 4.1 addition
Clause 4.2 gains a note saying interested parties can have climate-related requirements. ISO and the IAF addressed this in a joint communiqué. The overall intent of clauses 4.1 and 4.2 remains the same. Both clauses already asked you to weigh all internal and external issues.
So the practical effect is small and the documentation effect is not. Your clause 4.1 analysis now has to show you considered climate change and reached a view. That holds even when the view is that it does not affect your ISMS. Our guide to clause 4.1 and organizational context covers how to record that.
The 2013 transition has ended
The transition window for firms certified against ISO 27001:2013 closed on 31 October 2025. Certificates against the 2013 edition no longer carry accredited status. If a supplier hands you one dated to the old edition, it is a historical document.
This matters in two directions. Check your own certificate names the 2022 edition, and check the certificates your vendors send you.
Who stands behind the certificate
A certificate is worth what the body behind it is worth. Certification bodies get assessed against ISO/IEC 17021-1 by a national accreditation body, and in North America there are two to know.
“Certification to ISO/IEC 27001 by SCC-accredited certification bodies is widely accepted internationally.”
Standards Council of CanadaOn ISMS accreditation
In the United States the equivalent is ANAB, which accredits certification bodies issuing ISO/IEC 27001 certifications. Both bodies sign the IAF Multilateral Recognition Arrangement. That is what makes a Toronto certificate count with a buyer in Dallas, and the reverse.
So the question to ask a certification body is not where it sits. It is who accredits it. An unaccredited certificate costs less and proves less, and a buyer who knows the difference will spot it.
How to use both standards together
- Scope the ISMS. Clause 4. Decide what sits inside and write it down, because everything downstream inherits this boundary.
- Assess risk. Clause 6.1.2. Identify risks to confidentiality, integrity and availability, and rank them.
- Treat the risk. Clause 6.1.3 a) and b). Decide what you will do about each risk and determine the controls that follow.
- Cross-check against Annex A. Clause 6.1.3 c). Compare your determined controls with the 93 and confirm you have not omitted a necessary one.
- Write the Statement of Applicability. Clause 6.1.3 d). Every Annex A control, included or excluded, with your justification either way.
- Open ISO 27002. Now, and only for the controls you kept. Read the guidance and build them.
- Run the management system. Clauses 7 to 10. Internal audit, management review, corrective action. This is where most first-time certifications fail.
Two of our longer guides pick this up in detail, a complete ISO 27001 guide and how to design and implement an ISMS. If you are weighing this against an American framework, so does ISO 27001 vs SOC 2.
Frequently asked questions
Can you get certified against ISO 27002?
No. ISO 27002 is guidance and contains no requirements, so nothing exists to audit against. Certification goes to ISO/IEC 27001. Any certificate naming ISO 27002 is not what it claims to be.
Do I need to buy both standards?
Most teams buy both. ISO 27001 gives you the requirements and the one-line Annex A controls. ISO 27002 gives you the implementation guidance behind each control. You can certify with only ISO 27001 in hand. Building the controls without the guidance is just harder work.
How many controls does ISO 27001:2022 have?
Annex A holds 93 controls in four themes. The 2013 edition had 114 in 14 domains. The drop is smaller than it looks. 57 old controls merged into 24 new ones, and 11 arrived with no predecessor.
Do I have to implement all 93 Annex A controls?
No. You determine controls from your risk treatment, then use Annex A as a cross-check. Your Statement of Applicability lists every Annex A control with a justification for including or excluding it. Exclusions are normal, and an auditor reads your reasoning rather than counting your controls.
Is my ISO 27001:2013 certificate still valid?
No. The transition window closed on 31 October 2025. Certificates against the 2013 edition no longer hold accredited status. Check that your own certificate names the 2022 edition, and check the ones your vendors send you.
What did the 2024 climate amendment change?
Amendment 1:2024 adds one sentence to clause 4.1. It asks you to determine whether climate change is a relevant issue. A note to clause 4.2 covers interested parties. ISO and the IAF say both clauses keep their original intent. In practice your context analysis has to show you considered it.
Does it matter which country my certification body is in?
Less than whether it holds accreditation. SCC accredits in Canada and ANAB in the United States, and both sign the IAF Multilateral Recognition Arrangement. That arrangement is what makes either certificate count across the border. An unaccredited certificate is the one to worry about.
Key takeaways
- ISO 27001 holds the requirements and is the only one of the two you can certify against.
- ISO 27002 explains how each control works. No clauses, no requirements, no certificate.
- Annex A is a cross-check against your risk treatment, not a list to work through.
- Clauses 4 to 10 carry the requirements. Clauses 7 to 10 are where first-time certifications tend to fail.
- 93 controls in four themes. 57 merged into 24, and 11 are new.
- Amendment 1:2024 adds climate change to clause 4.1. Small change, real documentation consequence.
- The 2013 transition window closed on 31 October 2025.
- Accreditation matters more than the certification body’s country. SCC in Canada, ANAB in the United States, both under the IAF arrangement.
Working through Annex A when you should be working through risk?
We run the risk assessment, build the treatment plan, and write the Statement of Applicability so your controls trace back to something. A named compliance manager takes you to the certification audit. Same process whether you sell in Toronto, Dallas or both.