ISO/IEC 27001 vs. ISO/IEC 27002: ISMS, Annex A, and Security Controls Explained
Section titled “ISO/IEC 27001 vs. ISO/IEC 27002: ISMS, Annex A, and Security Controls Explained”What Is ISO/IEC 27001?
Section titled “What Is ISO/IEC 27001?”ISO/IEC 27001 is an international standard that specifies requirements for an information security management system (ISMS). An ISMS helps an organization identify, manage, monitor, and continually improve its information security risks.
The standard applies to organizations of different sizes and industries. It addresses governance, risk assessment and treatment, responsibilities, documented information, monitoring, internal audits, management reviews, and improvement—not just technical security tools.
Its formal designation is ISO/IEC 27001, although “ISO 27001” is commonly used. It is developed jointly within the standards framework of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
As of October 2026, the underlying edition is ISO/IEC 27001:2022, together with Amendment 1:2024. The amendment requires organizations to determine whether climate change is a relevant issue in their organizational context; it does not impose a universal requirement to deploy specific climate-change security measures.
What Is ISO/IEC 27002?
Section titled “What Is ISO/IEC 27002?”ISO/IEC 27002 is an international standard providing a reference set of information security controls and implementation guidance.
Where ISO/IEC 27001 specifies requirements for running an ISMS, ISO/IEC 27002 explains how organizations can approach individual security controls. For example, an organization may decide it needs stronger access management after assessing its risks, then use ISO/IEC 27002 to design account provisioning, access reviews, and timely access removal.
ISO/IEC 27002 is guidance, not a mandatory step-by-step implementation manual. Controls should be adapted to the organization’s context and risks.
ISO/IEC 27001 vs. ISO/IEC 27002
Section titled “ISO/IEC 27001 vs. ISO/IEC 27002”| Aspect | ISO/IEC 27001 | ISO/IEC 27002 |
|---|---|---|
| Purpose | Define ISMS requirements | Provide information security control guidance |
| Focus | Management system and continual improvement | Selection, design, and implementation of controls |
| Contents | Context, leadership, planning, support, operation, evaluation, improvement, and Annex A | Controls, their purposes, and implementation guidance |
| Certification | Organizations can obtain accredited third-party ISMS certification against the standard | No equivalent standalone ISO/IEC 27002 ISMS certification |
| Typical audience | Executives, ISMS owners, risk managers, auditors | Security architects, IT operations, security teams, ISMS practitioners |
In short: ISO/IEC 27001 defines ISMS requirements; ISO/IEC 27002 helps practitioners implement security controls.
ISMS vs. ISO/IEC 27001 vs. Certification
Section titled “ISMS vs. ISO/IEC 27001 vs. Certification”These related terms describe different things:
- ISMS: The actual management system operated by an organization, including governance, risk assessments, security policies, operating procedures, awareness, assurance, and improvement.
- ISO/IEC 27001: The standard defining requirements that an ISMS should meet.
- ISMS certification: An independent certification body’s assessment that an ISMS conforms to ISO/IEC 27001 within a defined scope.
An organization can operate an ISMS without seeking certification. Certification does not guarantee that no breach will occur, nor does it necessarily cover every subsidiary, site, service, or product. Always check the certified scope and certification validity.
Main ISO/IEC 27001 Requirements
Section titled “Main ISO/IEC 27001 Requirements”The core management system requirements are in Clauses 4–10.
| Clause | Topic | Example activities |
|---|---|---|
| 4 | Context of the organization | Identify internal/external issues, interested parties, and ISMS scope |
| 5 | Leadership | Establish policy, responsibilities, and management commitment |
| 6 | Planning | Assess risks, plan risk treatment, set objectives |
| 7 | Support | Provide resources, competence, awareness, communications, and documented information |
| 8 | Operation | Operate planned processes, conduct risk assessments and treatment |
| 9 | Performance evaluation | Monitor and measure performance, conduct internal audits and management reviews |
| 10 | Improvement | Address nonconformities, take corrective action, and improve continually |
These are management system requirements. By contrast, the Annex A reference controls are selected or excluded according to risk treatment decisions, subject to the standard’s requirements for that process.
What Is Annex A?
Section titled “What Is Annex A?”Annex A of ISO/IEC 27001 is a reference list of information security controls used to check that no necessary controls have been overlooked during risk treatment. In the 2022 edition, it corresponds to the 93 controls described in ISO/IEC 27002:2022.
Annex A is not a mandate to implement every control regardless of risk. An organization determines necessary controls through its risk assessment and risk treatment process, compares them with Annex A, and may also use controls beyond those listed in Annex A.
The Four Control Themes
Section titled “The Four Control Themes”| Theme | Number of controls | Examples |
|---|---|---|
| Organizational controls | 37 | Policies, asset management, supplier relationships, incident management |
| People controls | 8 | Awareness, confidentiality obligations, changes in employment |
| Physical controls | 14 | Physical access, equipment protection, storage media |
| Technological controls | 34 | Access control, malware protection, logging, cryptography, backups |
| Total | 93 |
The 2013 edition had 114 controls arranged across 14 categories. The 2022 edition reorganized and consolidated them into 93 controls under four themes. This does not mean that 21 security practices simply became unnecessary.
Annex A vs. ISO/IEC 27002
Section titled “Annex A vs. ISO/IEC 27002”Both contain corresponding controls, but they serve different purposes.
| Aspect | ISO/IEC 27001 Annex A | ISO/IEC 27002 |
|---|---|---|
| Role | Reference control list | Control guidance standard |
| Coverage | 93 reference controls | 93 corresponding controls |
| Detail | Control identifiers, names, and statements | Control descriptions, purposes, and implementation guidance |
| Primary use | Check completeness of the selected controls | Help design and operate the controls |
Practical Example: Access Rights
Section titled “Practical Example: Access Rights”Suppose employees who have left the company might still retain access to internal applications.
- Identify and assess the risk: Unused accounts could enable unauthorized access.
- Determine risk treatment under ISO/IEC 27001: Select account deactivation and access review processes.
- Compare against Annex A: Check relevant controls, such as A.5.18 Access rights, to identify any omissions.
- Consult ISO/IEC 27002: Develop procedures for authorization, periodic review, and modification or removal of access rights.
- Collect evidence: Retain account disablement tickets, access review records, and exception approvals.
This illustrates the relationship between risk-based ISMS requirements, Annex A’s reference controls, and ISO/IEC 27002’s practical guidance.
What Is a Statement of Applicability (SoA)?
Section titled “What Is a Statement of Applicability (SoA)?”The Statement of Applicability (SoA) documents the controls determined to be necessary and explains their applicability. It is a key output of the ISO/IEC 27001 information security risk treatment process.
The SoA must identify necessary controls, justify their inclusion, state whether they are implemented, and justify the exclusion of Annex A controls.
| Field | Illustrative example |
|---|---|
| Control | A.5.18 Access rights |
| Applicability | Applicable |
| Justification | Prevent unnecessary access after employee departures or transfers |
| Implementation | Operating; quarterly access reviews performed |
| Evidence | Access register, review records, offboarding tickets |
Excluding a reference control from Annex A is not the same as excluding the mandatory management system requirements in Clauses 4–10. An Annex A exclusion must be justified through the SoA and the organization’s risk treatment decisions.
How to Implement an ISMS
Section titled “How to Implement an ISMS”- Define the scope: Identify included teams, activities, locations, services, and information.
- Understand assets and risks: Identify important information, threats, vulnerabilities, and potential impact.
- Assess risks: Apply defined criteria to evaluate the risks and their acceptability.
- Plan risk treatment: Decide how to modify, avoid, share, or retain risks and determine necessary controls.
- Check Annex A and prepare the SoA: Ensure necessary controls have not been omitted; explain inclusion and exclusion decisions.
- Implement controls with ISO/IEC 27002 guidance: Establish procedures, technical safeguards, training, and ownership.
- Operate, evaluate, and improve: Monitor outcomes, audit the ISMS, conduct management reviews, and address nonconformities.
- Seek certification if appropriate: Obtain an independent audit for a defined scope and maintain the ISMS after certification.
The ultimate objective is continuous risk management, not merely passing an audit.
International Standards and Japanese JIS Adoption
Section titled “International Standards and Japanese JIS Adoption”Japan publishes corresponding Japanese Industrial Standards (JIS). The relationship is relevant to organizations operating in Japan or interpreting Japanese ISMS requirements.
| International publication | Corresponding Japanese publication |
|---|---|
| ISO/IEC 27001:2022 | JIS Q 27001:2023 |
| ISO/IEC 27001:2022/Amd 1:2024 | JIS Q 27001:2025 (amendment) |
| ISO/IEC 27002:2022 | JIS Q 27002:2024 |
The Japanese amendment should be read together with the underlying standard; it is not a standalone replacement for every clause.
Key Takeaways
Section titled “Key Takeaways”ISO/IEC 27001 provides the requirements for a risk-based, continually improving ISMS. ISO/IEC 27002 provides guidance for implementing information security controls. Annex A of ISO/IEC 27001 acts as a reference list of 93 controls, while the Statement of Applicability records which controls are necessary, their status, and the justification for excluding Annex A controls.
For engineering and operations teams, effective implementation means connecting technical safeguards with organizational risk assessments, clear control ownership, evidence, and continual improvement.
References
Section titled “References”- ISO — ISO/IEC 27001:2022
- ISO — ISO/IEC 27002:2022
- ISO — ISO/IEC 27001:2022/Amd 1:2024
- ISMS Accreditation Center (Japan) — Overview of the ISMS conformity assessment scheme
- ISO/IEC JTC 1/SC 27 — Technical overview of ISO/IEC 27002:2022
This is an educational overview, not a substitute for the copyrighted normative text. Refer to the applicable published standards for audits and formal conformity decisions.