ISO 27001 vs. 27002 vs. 27003

What is ISO 27001?

Published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), ISO 27001 is the core standard in the ISO/IEC 27000 series, a collection of documents outlining standards for information security management.

ISO 27001, also known as ISO/IEC 27001, is the central certification standard for establishing, implementing, maintaining and continually improving an information security management system (ISMS). The current edition is ISO/IEC 27001:2022. Organizations certified to the 2013 edition had until October 31, 2025 to transition, and 2013 certificates are no longer valid.

An ISMS is a systematic approach to managing information security risk: a documented set of policies, processes and security controls designed to protect the confidentiality, integrity and availability of assets from threats and vulnerabilities. While not all organizations pursue certification, many use ISO 27001 as a guiding framework for developing and implementing information security best practices.

ISO 27001, or 27001:2022 , provides guidance on the selection, implementation and management of security controls based on an organization's information security risk environment. It is a supplementary standard that supports ISO 27001, describing in detail the information security controls an organization may apply from the ISO 27001 list.

ISO 27001:2022 organizes 93 controls into four themes, which Annex A of ISO 27001:2022 mirrors:

organizational controls (37)
people controls (8)
physical controls (14)
technological controls (34)

The 2022 edition replaces the 2013 structure of 114 controls in 14 groups and added 11 new controls, including threat intelligence, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.

According to the International Organization for Standardization, ISO 27002 is designed to be used by organizations that intend to:

select controls within the process of implementing an ISMS based on ISO/IEC 27001
implement commonly accepted information security controls
develop their own information security management guidelines

What is ISO 27003?

ISO 27003, also called ISO/IEC 27003:2017, provides guidance for implementing an ISMS based on ISO 27001.

ISO 27003 covers how to specify and design an ISMS, from the first proposal through the project plan. It describes how to.

obtain management approval to implement an ISMS
define an ISMS implementation project
plan the ISMS project

Organizations that follow ISO 27003 produce a final ISMS project implementation plan.

Clauses 4 through 10 mirror the organization of ISO 27001, making them easy to compare and reference. The descriptions follow the same structure throughout:

Required activity. Outlines key activities required in the corresponding subclause of ISO/IEC 27001
Explanation. Explains what the requirements of ISO/IEC 27001 imply
Guidance: Provides additional details and supporting information to implement the “required activity,” with examples
Other information: Supplies further information that can be considered

ISO 27001 vs. ISO 27002

The main difference between ISO 27001 and ISO 27002 is that ISO 27002 is a detailed supplementary guide to the security controls in the ISO 27001 framework.

ISO 27002 provides best-practice guidance on selecting and implementing the controls listed in ISO 27001. These controls are listed in Annex A of ISO 27001:2022, which contains 93 security controls in four themes.

Where ISO 27001 provides a brief outline of each control, ISO 27002 describes it in depth: how the control works, its purpose and objectives, and how to implement it. ISO 27002 is a supporting document, so read it alongside ISO 27001.

ISO 27001 vs. 27002 certification

ISO 27002 is not a certification standard; you can only certify to ISO 27001. ISO 27002 is a supporting guide, while ISO 27001 provides the full list of requirements for an ISMS.

ISO 27001 vs. ISO 27003

ISO 27003 provides guidance for all the requirements of an ISMS described under ISO 27001. This includes recommendations ("should"), possibilities ("can") and permissions ("may") related to those requirements.

ISO 27003 is not a certification standard like ISO 27001, so organizations are under no obligation to follow its guidance. As a supporting document, ISO 27003 does not add any new requirements or definitions beyond ISO 27001. It is intended to be used alongside ISO 27001 to provide further guidance and context for the requirements listed.

The guidance in ISO 27003 is generic and applies to all organizations, regardless of size, type or nature, so each organization applies it in light of its own context.

ISO 27002 vs. ISO 27003

Like ISO 27002, ISO 27003 is not a certification standard, but both provide valuable support to organizations working to meet ISO 27001 requirements.

ISO 27002 focuses its guidance on "determining and implementing controls for information security risk treatment in an information security management system (ISMS) based on ISO 27001." ISO 27003 focuses its guidance more broadly on the overall requirements for an ISMS based on ISO 2701.

Together, ISO 27002 and ISO 27003 help organizations understand, identify and implement the requirements outlined in ISO 27001.

Why ISO 27001 matters

ISO 27001 gives an organization a recognized, auditable way to manage information security risk, and certification proves it to customers, partners and regulators. Between ISO 27001 and its supporting ISO 27002 and ISO 27003 documents, organizations that follow the standards can:

meet business, legal and regulatory expectations
reduce the risk of a data breach
reduce exposure to financial penalties and losses
strengthen their reputation and competitive position
measure and improve their security posture against a common benchmark

Certification takes real work: 93 controls in four themes to assess, a risk treatment plan to build and an ISMS to run and improve year after year. ISO 27002 and ISO 27003 exist to make that work manageable.

When to use each standard

How and when you use each standard depends on your goals and current security posture.

When to use ISO 27001

ISO 27001 is the foundation for an effective information security management system, focusing on two key objectives:

risk assessment (identifying potential risks and vulnerabilities to data in the organization).
risk treatment (determining what steps to take to safeguard that data).

Organizations should use ISO 27001 when they:

want to achieve certification to international security standards.
don't have an ISMS and want to develop one based on best practices.
want to assess and treat security risks in the organization.
need to comply with business, legal and regulatory requirements.

When to use ISO 27002

ISO 27002 expands on the controls in Annex A of ISO 27001 to provide further detail and guidance to organizations selecting and implementing security controls. Use ISO 27002 while choosing controls for the risk treatment plan and as you implement them.

When to use ISO 27003

ISO 27003 provides additional guidance for all the requirements outlined in ISO 27001. Use ISO 27003 as a supplemental guide to define and plan an ISMS implementation project.

ISO 27002 and ISO 27003 help organizations apply the framework they developed in ISO 27001, so use them alongside the ISO 27001 initiative.