ISO 27001 defines the management system, the ISMS, and is the standard you certify against. ISO 27002 is a reference set of 93 controls with implementation guidance. Annex A of the 2022 edition of ISO 27001 aligns with the ISO 27002 controls, so you use 27001 for the process and 27002 for the detail.
Two documents, two jobs
ISO 27001 tells you how to run an information security management system: set scope, assess risk, choose controls, measure, audit and improve. Auditors assess you against it.
ISO 27002 does not tell you how to run a system. It describes controls, what they are for and how to implement them. It can also serve as a standalone control set, outside a certified ISMS.
How they connect
The 2022 revision of ISO 27002 has 93 controls in four themes. Those controls replace the older Annex A set of 114 controls in ISO 27001. Annex A was updated so it lines up with the new structure.
In practice:
- Your Statement of Applicability refers to the controls in ISO 27001 Annex A.
- When you need to know how to implement one, you read the matching guidance in ISO 27002.
- Annex B of ISO 27002 maps the 2013 controls to the 2022 ones, which helps if you have older documents.
What changed in 2022
Compared with 2013, the guidance reports 11 new controls, 24 controls merged from earlier ones, and 58 updated mostly in guidance. The 14 older domains became four themes. Each control also gained its own purpose statement, where before an objective applied to a group.
Which should you cite?
It depends on the audience:
- For certification and the SoA, cite ISO 27001 and its Annex A control numbers.
- For internal procedures, cite the ISO 27002 control the procedure supports, since it holds the guidance.
- For a customer questionnaire, say which standard you are certified or aligned to, and be exact. Alignment with ISO 27002 is not a certificate.
That last point matters. You cannot be certified to ISO 27002 in the way you are to ISO 27001, so avoid wording that suggests it.
Do you need to buy both?
Both are published by ISO and sold. Summaries from consultancies are useful for learning but are not the text. If you will build a real ISMS, read the standard itself.
A common wording mistake
Security questionnaires often ask whether you follow ISO 27002. Answer with what is true. You might say your controls are designed with reference to it, which is different from saying a body has certified you. If your certificate is against ISO 27001, name that, give the scope and the issuing body, and offer the certificate itself. Precision here saves awkward follow up later.
Quick check
Can a company be certified to ISO 27002?
Certification is against ISO 27001. ISO 27002 is a code of practice and guidance set, so describe it as a control reference, not a certificate.
Does the SoA reference 27001 or 27002?
The SoA refers to ISO 27001 Annex A. Your own control descriptions can reference ISO 27002 for guidance.
Sources
- ISO 27002 revisions and updates comparison
- How to prepare for ISO/IEC 27001:2022
- ISO/IEC 27002:2022, understanding the update
Last reviewed: 19 October 2026.
