The ISO/IEC 27000 series is a family of international standards for information security. One of them, ISO/IEC 27001, is certifiable and well known. The others give vocabulary, guidance and sector-specific advice. Knowing how they fit together saves time when you build a security programme or prepare for an audit.
This guide explains the most important standards in the family and when to use each.
How the family is organised
The standards fall into four broad groups:
- Vocabulary and overview: ISO/IEC 27000 defines the terms used across the family.
- Requirements: standards you can certify against, mainly ISO/IEC 27001 and its extensions.
- Guidance: standards that explain how to implement controls and processes.
- Sector and topic guidance: advice for cloud, privacy, energy, telecom and more.
The key standards
| Standard | Title (short) | What it does |
|---|---|---|
| ISO/IEC 27000 | Overview and vocabulary | Definitions and an introduction to ISMS |
| ISO/IEC 27001 | ISMS requirements | The certifiable standard |
| ISO/IEC 27002 | Information security controls | Guidance for each of the 93 controls |
| ISO/IEC 27003 | ISMS guidance | Help with implementing ISO 27001 clauses |
| ISO/IEC 27004 | Monitoring and measurement | How to measure ISMS performance |
| ISO/IEC 27005 | Risk management | Guidance on information security risk management |
| ISO/IEC 27006 | Requirements for certification bodies | Rules for organizations that audit and certify |
| ISO/IEC 27007 | ISMS auditing | Guidance for auditing an ISMS |
| ISO/IEC 27017 | Cloud security | Extra controls for cloud providers and customers |
| ISO/IEC 27018 | Personal data in the public cloud | Privacy protection for cloud processors |
| ISO/IEC 27035 | Incident management | How to plan for and handle security incidents |
| ISO/IEC 27701 | Privacy information management | Extends the ISMS to privacy (PIMS) |
| ISO/IEC 27019 | Energy utilities | Controls for energy-sector process control systems |
| ISO/IEC 27799 | Health informatics | Applying 27002 in healthcare |
ISO/IEC 27001 and 27002: the core pair
ISO/IEC 27001 sets the requirements for an ISMS: context, leadership, risk assessment, controls, audits and improvement. Annex A lists 93 reference controls. ISO/IEC 27002 then explains each control: its purpose, how to implement it and related attributes. In practice, implementers keep both open side by side.
Both were updated in 2022, and organizations certified to the 2013 version had to move to the 2022 version by 31 October 2025. Read our introduction to ISO/IEC 27001 and the Annex A controls guide.
Risk management: ISO/IEC 27005
ISO 27001 requires a risk assessment but does not prescribe a method. ISO/IEC 27005 fills that gap with guidance on identifying, analysing, evaluating and treating risks. The 2022 edition aligns with ISO 31000, the general risk management standard.
Privacy: ISO/IEC 27701
ISO/IEC 27701 adds privacy requirements on top of an ISMS. It helps organizations act as data controllers or processors under laws such as the GDPR and India’s DPDP Act. A newer edition allows it to be used as a standalone management system as well.
Cloud: ISO/IEC 27017 and 27018
Cloud providers often certify against ISO 27001 with 27017 and 27018 added to the scope. As a customer, ask for these when you assess providers.
Which standards do you need?
- Getting certified: ISO/IEC 27001, with 27002 as guidance.
- Building a risk method: ISO/IEC 27005.
- Handling personal data: add ISO/IEC 27701.
- Running or buying cloud services: ISO/IEC 27017 and 27018.
- Planning incident response: ISO/IEC 27035.
FAQ
Can you certify against ISO 27002?
No. ISO 27002 is guidance. Certification is against ISO 27001, and some extensions such as 27701.
Are these standards free?
No. You buy them from ISO or a national standards body, such as BIS in India.
Sources
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. Doing it yourself? The ISO 27001:2022 Starter Kit (₹1,999) gives you the gap workbook, risk register, Statement of Applicability and 13 policy templates. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
