A questionnaire asks whether you are "ISO 27002 certified". A new hire asks which of the two standards they should read first. An engineer finds a control in Annex A that is one sentence long and wants to know what it actually expects.
All three questions come from the same confusion. ISO/IEC 27001 and ISO/IEC 27002 share a numbering scheme and a list of 93 controls, but they do different jobs. One is a set of requirements. The other is guidance.
This article explains what each document contains, how they line up, and how to use the guidance without letting it become an unintended checklist.
ISO 27001 sets the requirements you are audited against
ISO/IEC 27001:2022 specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system. Its requirements are written with "shall". It is the document in the family that an ISMS is certified against.
It has two parts that matter in practice:
Clauses 4 to 10. The management system itself: context, leadership, planning, support, operation, performance evaluation, and improvement. Every requirement in these clauses applies. You cannot exclude clause 9.2 because you would rather not run an internal audit.
Annex A. A normative table of 93 information security controls, grouped into four themes. Each entry is a short control statement, usually one or two sentences.
Annex A works differently from the clauses. Clause 6.1.3 requires you to determine the controls your risk treatment needs, then compare them with Annex A to verify that no necessary control has been omitted. Your Statement of Applicability records the result: which controls apply, whether they are implemented, and why any are excluded. The standard also notes that Annex A is not exhaustive, and that you can add controls from any source.
Certification bodies raise nonconformities against these requirements, and against your own ISMS documentation, which becomes audit criteria once you adopt it. That second point is easy to miss. If your policy says access is reviewed quarterly, the auditor can hold you to quarterly.
ISO 27002 explains how to implement each control
ISO/IEC 27002:2022 is a reference set of information security controls with implementation guidance. Its recommendations are written with "should". There is no certification to ISO 27002, so "ISO 27002 certified" is not a real status. A correct answer to that questionnaire line is that you are certified to ISO 27001, with controls informed by ISO 27002.
For each of the 93 controls, ISO 27002 provides:
Control: the same statement that appears in Annex A of ISO 27001
Purpose: why the control exists
Guidance: how it might be implemented, often several pages
Other information: related standards and points to consider
It also assigns each control a set of attributes, a feature added in the 2022 edition. There are five attribute types: control type (preventive, detective, corrective), information security properties (confidentiality, integrity, availability), cybersecurity concepts (identify, protect, detect, respond, recover), operational capabilities, and security domains. Annex B of ISO 27002 maps the 2022 controls to the 2013 edition, which helps when you are reading older policies.
How the two documents line up
The numbering is shared on purpose. Control 8.15 in Annex A of ISO 27001 is logging; control 8.15 in ISO 27002 is the guidance for logging. ISO 27001 states that its Annex A controls are directly derived from, and aligned with, those in ISO 27002.
| Question | ISO/IEC 27001:2022 | ISO/IEC 27002:2022 |
|---|---|---|
| What is it? | Requirements for an ISMS | Guidance on information security controls |
| Verb | "shall" | "should" |
| Can you be certified to it? | Yes | No |
| Clauses on the management system | Yes, clauses 4 to 10 | No |
| Control content | One short statement per control | Statement, purpose, guidance, other information |
| Attributes | No | Five attribute types per control |
| Who reads it closely | ISMS owner, internal auditor | Control owners, implementers |
Using ISO 27002 without turning it into a checklist
The most common mistake with ISO 27002 is treating every "should" as a "shall". A team reads several pages of guidance on secure coding, decides each paragraph is mandatory, and either overbuilds or marks the control as partially implemented when it is not.
The guidance is a description of good practice, not a test. Your obligation is to implement the controls your risk treatment requires, to the extent your risks justify, and to record that in your Statement of Applicability. Three habits keep that straight:
Read the purpose first. It tells you the risk the control addresses. Your implementation should address that risk in your environment, whether or not it resembles the guidance text.
Record deliberate differences. Where you have chosen not to follow a piece of guidance, note why in the control description. An auditor who asks "why not?" will accept a reasoned answer far more readily than silence.
Use the attributes as filters, not as requirements. They are useful for questions like "which of our controls are detective?" or "what covers the respond function?" They add no obligations of their own.
Auditors do read ISO 27002, and it shapes their expectations. If your implementation of a control is far from the guidance, expect to explain it. That is a conversation about your reasoning, not a nonconformity in itself.
The four themes, and how the controls are distributed across them, are covered in the ISO 27001:2022 Annex A themes, explained. Recording your decisions is covered in how to write a Statement of Applicability.
The rest of the 27000 family, briefly
ISO 27001 and ISO 27002 sit within a larger family. You will meet the others in auditor conversations and in questionnaires. Most of them are guidance.
ISO/IEC 27000: overview and vocabulary. When a term in ISO 27001 is unclear, the definition is here.
ISO/IEC 27003: guidance on the ISMS clauses of ISO 27001, the counterpart to what ISO 27002 does for controls.
ISO/IEC 27004: guidance on monitoring, measurement, analysis, and evaluation, which supports clause 9.1.
ISO/IEC 27005: guidance on information security risk management, which supports clauses 6.1 and 8.
ISO/IEC 27006: requirements for the bodies that audit and certify ISMSs. It governs your certification body, not you.
ISO/IEC 27007: guidance for auditing an ISMS, useful when you run your own internal audit.
ISO/IEC 27017 and 27018: codes of practice extending ISO 27002 for cloud services and for protecting personal data in public clouds.
ISO/IEC 27701: requirements for privacy information management, which organizations can be certified against, covered in ISO 27701 explained.
The editions change on different schedules. When a document matters to your audit, confirm which edition your certification body is working from.
Which one each person on your team needs
Your ISMS owner and your internal auditor need ISO 27001 itself, closely read. They need to know every clause, because every clause applies.
Control owners benefit most from ISO 27002, for the controls they own. An engineering lead responsible for the technological controls will get more from the guidance on configuration management, logging, and secure development than from the management system clauses.
Everyone else needs neither. They need your policies, written in your own terms. If staff have to read an ISO standard to know what is expected of them, the policy has not done its job.
How TrustLynce helps
TrustLynce keeps your Statement of Applicability tied to the controls you actually run, with each Annex A control linked to its owner, its implementation description, and its evidence. Control mapping lets the same control satisfy ISO 27001 and other frameworks you hold, so guidance you adopt once is recorded once.