ISO 27001 vs ISO 27002: What is the Difference? (2022 Update)

When you first start your journey toward information security compliance, the “ISO 27000 family” can feel like a maze. Two numbers come up more than any others: ISO 27001 and ISO 27002. At first glance, they seem to cover the same ground, but they actually serve two very different—yet equally important—purposes. If you are a compliance manager, IT professional, or auditor, understanding this distinction is the key to building a successful Information Security Management System (ISMS).

In short, ISO 27001 is the rulebook you must follow to get certified, while ISO 27002 is the detailed “how-to” manual for implementing specific security controls. Using a professional ISO 27001 toolkit that incorporates the guidance from both standards is the most efficient way to achieve compliance without wasting hundreds of hours on manual research.

What is ISO 27001?

ISO 27001 is the international standard that sets out the requirements for an ISMS. It is a “management standard,” meaning it focuses on the high-level processes of how a company should manage its security. It covers everything from leadership commitment and risk assessment to internal audits and continuous improvement.

Crucially, ISO 27001 is the only standard in the family that you can be certified against. When a company says they are “ISO 27001 Certified,” they have proven to an auditor that they meet the requirements of this specific standard. It includes a short list of 93 security controls (in the 2022 version) located in Annex A, but it doesn’t give much detail on how to set them up.

What is ISO 27002?

ISO 27002 is a supplementary standard that acts as a “code of practice.” While ISO 27001 tells you what you need to do (e.g., “You must have a password policy”), ISO 27002 tells you how to do it (e.g., “Passwords should be 12 characters long, changed every 90 days, and include special characters”).

You cannot get an ISO 27002 certification. Instead, organizations use it as a reference guide to help them implement the controls mentioned in ISO 27001’s Annex A. Because it provides so much detail, an ISO 27001 documentation toolkit is often based heavily on the best practices found in ISO 27002.

Key Differences: ISO 27001 vs ISO 27002

To help you choose the right path for your organization, here is a quick breakdown of the core differences:

Feature	ISO 27001	ISO 27002
Primary Purpose	Certification and Management	Implementation Guidance
Certifiable?	Yes	No
Focus	Risk assessment and ISMS structure	Technical and organizational controls
Level of Detail	High-level (1-2 sentences per control)	Very detailed (1-2 pages per control)
Mandatory?	Yes, for certification	No, it is a recommendation

Why You Need an ISO 27001 Templates Toolkit for Both

Even though ISO 27002 isn’t mandatory for certification, an auditor will expect your security controls to be based on “industry best practices.” If you try to build your ISMS using only the brief descriptions in ISO 27001, your documentation will likely be too thin to pass an audit.

Using a comprehensive ISO 27001 templates toolkit from ISO 27001 Pro bridges this gap. It provides:

• Audit-ready policies that meet the requirements of ISO 27001.
• Detailed procedures that follow the guidance of ISO 27002.
• Time-saving templates so you don’t have to read 150+ pages of the standard yourself.

The 2022 Update: Themes and Controls

The latest update (ISO 27001:2022 and ISO 27002:2022) changed how controls are organized. Instead of 14 complex domains, controls are now grouped into 4 Themes:

• Organizational Controls (37 controls) – e.g., Cloud services, policies.
• People Controls (8 controls) – e.g., Remote working, screening.
• Physical Controls (14 controls) – e.g., Secure areas, equipment.
• Technological Controls (34 controls) – e.g., Encryption, secure coding.

The total number of controls was reduced from 114 to 93, but 11 brand-new controls were added to address modern threats like Threat Intelligence and Data Leakage Prevention. An ISO 27001 toolkit free download might still be using the old 2013 version, which could lead to an automatic audit failure today.

Free vs. Premium Documentation

While you might search for a free ISO 27001 toolkit to save money, be careful. Most free versions only cover the 7 main clauses of ISO 27001 and completely ignore the 93 controls from ISO 27002. A premium ISO 27001 documentation toolkit ensures that every policy you write is “linked” – meaning your Risk Assessment connects to your Statement of Applicability, which connects back to your ISO 27002-guided procedures.

Conclusion

Think of ISO 27001 as the “Goal” and ISO 27002 as the “Game Plan.” You need the first to prove your compliance to the world, but you need the second to actually build a secure company.

At iso27001pro.com, we simplify this entire process. Our ISO 27001 Pro toolkits are designed by lead auditors to ensure you meet every requirement of ISO 27001 while following the gold-standard guidance of ISO 27002.

➡️ Download the Complete ISO 27001:2022 Toolkit here and get audit-ready today!

FAQ: ISO 27001 vs 27002

What is the main difference between ISO 27001 and 27002?

ISO 27001 is the certifiable framework for an ISMS, while ISO 27002 is a supplementary guide providing implementation details for security controls.Do I need to buy both standards?

Technically, you only need ISO 27001 for certification. However, without the guidance in ISO 27002, implementing the controls correctly is much more difficult.

What is an ISO 27001 documentation toolkit?

It is a collection of pre-written templates that help you satisfy the requirements of ISO 27001 using the best-practice guidelines of ISO 27002.

Is ISO 27002:2022 different from the 2013 version?

Yes. The 2022 version reorganized 114 controls into 93 controls across four themes and added new controls like Threat Intelligence and Cloud Security. You can read more about these updates at the official ISO website.