ISO 27001 is the more well-known standard – and the
one that organisations certify to – neither can be considered in isolation.
However, ISO 27002 is a supplementary standard that provides advice on how to
implement the security controls listed in Annex A of ISO 27001.
Difference between ISO 27001 and ISO 27002 are:-
ISO 27001-
ISO 27001 is the
central framework of the ISO 27000 series, which is a series of documents
relating to various parts of information security management. The Standard
contains the implementation requirements for an ISMS. These are essentially an
overview of everything you must do achieve compliance, which is particularly
useful at the start of your project, or if you’re looking for general advice
but can’t commit to a full-scale ISO 27001 implementation project. To meet
these requirements, organizations must:-Assemble a project team and initiate
the project; Conduct a gap analysis; Scope the ISMS; Initiate high-level policy
development.
ISO 27002-
27002 is a
supplementary standard that focuses on the information security controls that
organizations might choose to implement. These controls are listed in Annex A
of ISO 27001, which is what you’ll often see information security experts refer
to when discussing information security controls. However, whereas Annex A
simply outlines each control in one or two sentences, ISO 27002 dedicates an
average of one page per control. This is because the Standard explains how each
control works, what its objective is, and how you can implement it.
Main differences are:-
The difference is that
the ISO 27001 standard has an organizational focus and details requirements
against which an organization’s Information Security Management System (ISMS)
can be audited. ISO 27002 on the other hand is more focused on the individual
and provides a code of practice for use by individuals within an organization.
If you compare them you will see that they're structured similarly and that
they map to each other.
Certification-You can
certify to ISO 27001 but not to ISO 27002. That’s because ISO 27001 is a
management standard that provides a full list of compliance requirements,
whereas supplementary standards such as ISO 27002 address one specific aspect
of an ISMS.
Applicability- A key
thing to consider when implementing an ISMS is that not all information
security controls will apply to your organization.
ISO 27001 makes that
clear, specifying that organizations conduct a risk assessment to identify and
prioritise information security threats. ISO 27002 doesn’t mention this, so if
you were to pick up the Standard by itself, it would be practically impossible
to figure out which controls you should adopt.
User questions & answers