ISO 27001 vs ISO 27002: What Is the Difference? | Osto<\/title>\n<meta name=\"description\" content=\"ISO 27001 vs ISO 27002: one is the certifiable standard, the other is implementation guidance. What each does, how they work together, and which you need.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">ISO 27001 vs ISO 27002: a common source of confusion, cleared up. One is the standard you certify against, the other is the guidance that tells you how.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>6 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>ISO 27001 is the certifiable standard. It defines the ISMS and lists the Annex A controls you must consider. ISO 27002 is the companion guidance that explains, in detail, how to implement each of those controls.<\/p>\n <p>You get certified against ISO 27001, never ISO 27002. Think of 27001 as the what and 27002 as the how. You use both, but only one appears on your certificate.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#short\">The short answer<\/a><\/li>\n <li><a href=\"#relationship\">How they fit together<\/a><\/li>\n <li><a href=\"#compare\">Side by side<\/a><\/li>\n <li><a href=\"#use\">How you use each<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"short\">ISO 27001 vs ISO 27002: the short answer<\/h2>\n <p>The two are companions, not competitors. ISO 27001 is the standard that sets the requirements for an information security management system and lists the reference controls in <a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A<\/a>. ISO 27002 is a separate document that takes each of those controls and explains how to implement it, with detailed guidance, purpose statements, and practical advice. You certify against 27001; you consult 27002 while doing the work.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The one-line distinction<\/div>ISO 27001 tells you what your security programme must include. ISO 27002 tells you how to actually build each piece. Certification is against 27001 only.<\/div>\n\n <h2 class=\"sec\" id=\"relationship\">How ISO 27001 and ISO 27002 fit together<\/h2>\n <p>In the 2022 versions, the two line up neatly. The 93 controls in Annex A of ISO 27001 mirror the controls detailed in ISO 27002, so you can move from the short control title in 27001 to the full implementation guidance in 27002 for the same reference number.<\/p>\n\n <div style=\"background:linear-gradient(180deg,#fbfcff,#f4f6ff);border:1px solid #e3e6f5;border-radius:18px;padding:30px 32px;margin:28px 0;box-shadow:0 8px 30px rgba(28,38,122,.07)\">\n <div style=\"font-size:11.5px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;color:#3a46c0;margin-bottom:6px\">How the two fit together<\/div>\n <div style=\"font-size:19px;font-weight:800;color:#0e1330;margin-bottom:22px\">One certifies, the other guides<\/div>\n <svg viewBox=\"0 0 700 180\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"ISO 27001 is the certifiable standard, ISO 27002 is the implementation guidance\">\n <g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\">\n <rect x=\"30\" y=\"30\" width=\"270\" height=\"120\" rx=\"16\" fill=\"#eef0ff\" stroke=\"#3a46c0\" stroke-width=\"2\"\/>\n <text x=\"165\" y=\"62\" font-size=\"16\" font-weight=\"800\" fill=\"#3a46c0\">ISO 27001<\/text>\n <text x=\"165\" y=\"90\" font-size=\"12.5\" fill=\"#0e1330\">The standard you certify against<\/text>\n <text x=\"165\" y=\"112\" font-size=\"12.5\" fill=\"#5b6178\">Says WHAT: the ISMS and the<\/text>\n <text x=\"165\" y=\"129\" font-size=\"12.5\" fill=\"#5b6178\">controls you must consider<\/text>\n\n <rect x=\"400\" y=\"30\" width=\"270\" height=\"120\" rx=\"16\" fill=\"#e6f7f4\" stroke=\"#00c2a8\" stroke-width=\"2\"\/>\n <text x=\"535\" y=\"62\" font-size=\"16\" font-weight=\"800\" fill=\"#0a7a68\">ISO 27002<\/text>\n <text x=\"535\" y=\"90\" font-size=\"12.5\" fill=\"#0e1330\">The implementation guidance<\/text>\n <text x=\"535\" y=\"112\" font-size=\"12.5\" fill=\"#5b6178\">Says HOW: detailed advice for<\/text>\n <text x=\"535\" y=\"129\" font-size=\"12.5\" fill=\"#5b6178\">putting each control in place<\/text>\n\n <path d=\"M300 90 L400 90\" stroke=\"#9d97ff\" stroke-width=\"3\"\/>\n <circle cx=\"350\" cy=\"90\" r=\"4\" fill=\"#9d97ff\"\/>\n <\/g>\n <\/svg>\n<\/div>\n\n <h2 class=\"sec\" id=\"compare\">Side by side<\/h2>\n <div class=\"otable\"><table class=\"regtable\">\n <tr><th>Aspect<\/th><th>ISO 27001<\/th><th>ISO 27002<\/th><\/tr>\n <tr><td><strong>What it is<\/strong><\/td><td>The certifiable standard<\/td><td>Implementation guidance<\/td><\/tr>\n <tr><td><strong>What it answers<\/strong><\/td><td>What your ISMS must do<\/td><td>How to implement each control<\/td><\/tr>\n <tr><td><strong>Can you certify against it?<\/strong><\/td><td>Yes<\/td><td>No<\/td><\/tr>\n <tr><td><strong>Contains the ISMS clauses?<\/strong><\/td><td>Yes, Clauses 4 to 10<\/td><td>No<\/td><\/tr>\n <tr><td><strong>Level of control detail<\/strong><\/td><td>Short titles in Annex A<\/td><td>Full guidance per control<\/td><\/tr>\n <tr><td><strong>When you use it<\/strong><\/td><td>Scoping, certification, audit<\/td><td>While implementing controls<\/td><\/tr>\n <\/table><\/div>\n\n <h2 class=\"sec\" id=\"use\">How you use each in practice<\/h2>\n <p>In a real certification project, they play different roles at different moments. You work from ISO 27001 to understand the requirements, define your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/isms\/\">ISMS<\/a>, and prepare for the audit. You reach for ISO 27002 when your team asks “so how do we actually do this control properly?” for a specific Annex A item.<\/p>\n\n <div class=\"keyrow\">\n <div class=\"k1\"><div class=\"lab\">Reach for ISO 27001<\/div><div class=\"sm\" style=\"margin-top:4px\">Defining scope, building the ISMS, writing the Statement of Applicability, and preparing for the certification audit.<\/div><\/div>\n <div class=\"k2\"><div class=\"lab\">Reach for ISO 27002<\/div><div class=\"sm\" style=\"margin-top:4px\">Implementing a specific control and wanting detailed, practical guidance on how to do it well.<\/div><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path: less guidance-chasing, more running controls<\/h2>\n <p>ISO 27002 exists because implementing controls correctly is genuinely hard, which is why a whole document is devoted to explaining how. For a lean team, the challenge is not reading the guidance, it is turning it into controls that actually operate and produce evidence.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. Instead of translating ISO 27002 guidance into a stack of separate tools, the controls, access, encryption, logging, monitoring, cloud posture, and more, already run on one platform and map to the ISO 27001 Annex A references directly. You get the outcome ISO 27002 describes without assembling it by hand, which is why lean teams treat Osto as the default foundation for implementing the standard.<\/div>\n\n <div class=\"callout\">\n <h3>From guidance to controls that actually run.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the controls ISO 27002 describes, mapped straight to ISO 27001, with evidence in one place. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is the difference between ISO 27001 and ISO 27002?<\/summary><p>ISO 27001 is the certifiable standard that defines the ISMS and lists the Annex A controls. ISO 27002 is companion guidance explaining how to implement each control in detail. You certify against 27001; you consult 27002 while doing the work.<\/p><\/details>\n <details><summary>Can you get certified in ISO 27002?<\/summary><p>No. ISO 27002 is guidance, not a certifiable standard. Certification is only against ISO 27001. ISO 27002 supports implementation but is never the thing you are audited against.<\/p><\/details>\n <details><summary>Do I need both ISO 27001 and ISO 27002?<\/summary><p>In practice, yes. You work from ISO 27001 for the requirements and certification, and you use ISO 27002 for detailed guidance on how to implement each control well. They are designed to be used together.<\/p><\/details>\n <details><summary>How do the control numbers relate between them?<\/summary><p>In the 2022 versions they align: the 93 Annex A controls in ISO 27001 mirror the controls detailed in ISO 27002, so the same reference number takes you from the short title to the full implementation guidance.<\/p><\/details>\n <details><summary>Which one do I start with?<\/summary><p>Start with ISO 27001 to understand the requirements and define your ISMS, then use ISO 27002 as a reference when implementing specific controls. The certificate you are working toward is ISO 27001.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>ISO 27001 vs ISO 27002: What Is the Difference? | Osto ISO 27001 vs ISO 27002: a common source of\u2026<\/p>\n","protected":false},"author":8,"featured_media":785,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[298],"class_list":["post-784","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-iso-27001-vs-iso-27002"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=784"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/784\/revisions"}],"predecessor-version":[{"id":786,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/784\/revisions\/786"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/785"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":784,"date":"2026-08-16T19:53:20","date_gmt":"2026-08-16T19:53:20","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=784"},"modified":"2026-08-16T19:53:20","modified_gmt":"2026-08-16T19:53:20","slug":"iso-27001-vs-iso-27002","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/iso-27001-vs-iso-27002\/","title":{"rendered":"ISO 27001 vs ISO 27002: What Is the Difference?"},"content":{"rendered":"\n\n\n\n\n\nISO 27001 vs ISO 27002: What Is the Difference? | Osto<\/title>\n<meta name=\"description\" content=\"ISO 27001 vs ISO 27002: one is the certifiable standard, the other is implementation guidance. What each does, how they work together, and which you need.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">ISO 27001 vs ISO 27002: a common source of confusion, cleared up. One is the standard you certify against, the other is the guidance that tells you how.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>6 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>ISO 27001 is the certifiable standard. It defines the ISMS and lists the Annex A controls you must consider. ISO 27002 is the companion guidance that explains, in detail, how to implement each of those controls.<\/p>\n <p>You get certified against ISO 27001, never ISO 27002. Think of 27001 as the what and 27002 as the how. You use both, but only one appears on your certificate.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#short\">The short answer<\/a><\/li>\n <li><a href=\"#relationship\">How they fit together<\/a><\/li>\n <li><a href=\"#compare\">Side by side<\/a><\/li>\n <li><a href=\"#use\">How you use each<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"short\">ISO 27001 vs ISO 27002: the short answer<\/h2>\n <p>The two are companions, not competitors. ISO 27001 is the standard that sets the requirements for an information security management system and lists the reference controls in <a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A<\/a>. ISO 27002 is a separate document that takes each of those controls and explains how to implement it, with detailed guidance, purpose statements, and practical advice. You certify against 27001; you consult 27002 while doing the work.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The one-line distinction<\/div>ISO 27001 tells you what your security programme must include. ISO 27002 tells you how to actually build each piece. Certification is against 27001 only.<\/div>\n\n <h2 class=\"sec\" id=\"relationship\">How ISO 27001 and ISO 27002 fit together<\/h2>\n <p>In the 2022 versions, the two line up neatly. The 93 controls in Annex A of ISO 27001 mirror the controls detailed in ISO 27002, so you can move from the short control title in 27001 to the full implementation guidance in 27002 for the same reference number.<\/p>\n\n <div style=\"background:linear-gradient(180deg,#fbfcff,#f4f6ff);border:1px solid #e3e6f5;border-radius:18px;padding:30px 32px;margin:28px 0;box-shadow:0 8px 30px rgba(28,38,122,.07)\">\n <div style=\"font-size:11.5px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;color:#3a46c0;margin-bottom:6px\">How the two fit together<\/div>\n <div style=\"font-size:19px;font-weight:800;color:#0e1330;margin-bottom:22px\">One certifies, the other guides<\/div>\n <svg viewBox=\"0 0 700 180\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"ISO 27001 is the certifiable standard, ISO 27002 is the implementation guidance\">\n <g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\">\n <rect x=\"30\" y=\"30\" width=\"270\" height=\"120\" rx=\"16\" fill=\"#eef0ff\" stroke=\"#3a46c0\" stroke-width=\"2\"\/>\n <text x=\"165\" y=\"62\" font-size=\"16\" font-weight=\"800\" fill=\"#3a46c0\">ISO 27001<\/text>\n <text x=\"165\" y=\"90\" font-size=\"12.5\" fill=\"#0e1330\">The standard you certify against<\/text>\n <text x=\"165\" y=\"112\" font-size=\"12.5\" fill=\"#5b6178\">Says WHAT: the ISMS and the<\/text>\n <text x=\"165\" y=\"129\" font-size=\"12.5\" fill=\"#5b6178\">controls you must consider<\/text>\n\n <rect x=\"400\" y=\"30\" width=\"270\" height=\"120\" rx=\"16\" fill=\"#e6f7f4\" stroke=\"#00c2a8\" stroke-width=\"2\"\/>\n <text x=\"535\" y=\"62\" font-size=\"16\" font-weight=\"800\" fill=\"#0a7a68\">ISO 27002<\/text>\n <text x=\"535\" y=\"90\" font-size=\"12.5\" fill=\"#0e1330\">The implementation guidance<\/text>\n <text x=\"535\" y=\"112\" font-size=\"12.5\" fill=\"#5b6178\">Says HOW: detailed advice for<\/text>\n <text x=\"535\" y=\"129\" font-size=\"12.5\" fill=\"#5b6178\">putting each control in place<\/text>\n\n <path d=\"M300 90 L400 90\" stroke=\"#9d97ff\" stroke-width=\"3\"\/>\n <circle cx=\"350\" cy=\"90\" r=\"4\" fill=\"#9d97ff\"\/>\n <\/g>\n <\/svg>\n<\/div>\n\n <h2 class=\"sec\" id=\"compare\">Side by side<\/h2>\n <div class=\"otable\"><table class=\"regtable\">\n <tr><th>Aspect<\/th><th>ISO 27001<\/th><th>ISO 27002<\/th><\/tr>\n <tr><td><strong>What it is<\/strong><\/td><td>The certifiable standard<\/td><td>Implementation guidance<\/td><\/tr>\n <tr><td><strong>What it answers<\/strong><\/td><td>What your ISMS must do<\/td><td>How to implement each control<\/td><\/tr>\n <tr><td><strong>Can you certify against it?<\/strong><\/td><td>Yes<\/td><td>No<\/td><\/tr>\n <tr><td><strong>Contains the ISMS clauses?<\/strong><\/td><td>Yes, Clauses 4 to 10<\/td><td>No<\/td><\/tr>\n <tr><td><strong>Level of control detail<\/strong><\/td><td>Short titles in Annex A<\/td><td>Full guidance per control<\/td><\/tr>\n <tr><td><strong>When you use it<\/strong><\/td><td>Scoping, certification, audit<\/td><td>While implementing controls<\/td><\/tr>\n <\/table><\/div>\n\n <h2 class=\"sec\" id=\"use\">How you use each in practice<\/h2>\n <p>In a real certification project, they play different roles at different moments. You work from ISO 27001 to understand the requirements, define your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/isms\/\">ISMS<\/a>, and prepare for the audit. You reach for ISO 27002 when your team asks “so how do we actually do this control properly?” for a specific Annex A item.<\/p>\n\n <div class=\"keyrow\">\n <div class=\"k1\"><div class=\"lab\">Reach for ISO 27001<\/div><div class=\"sm\" style=\"margin-top:4px\">Defining scope, building the ISMS, writing the Statement of Applicability, and preparing for the certification audit.<\/div><\/div>\n <div class=\"k2\"><div class=\"lab\">Reach for ISO 27002<\/div><div class=\"sm\" style=\"margin-top:4px\">Implementing a specific control and wanting detailed, practical guidance on how to do it well.<\/div><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path: less guidance-chasing, more running controls<\/h2>\n <p>ISO 27002 exists because implementing controls correctly is genuinely hard, which is why a whole document is devoted to explaining how. For a lean team, the challenge is not reading the guidance, it is turning it into controls that actually operate and produce evidence.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. Instead of translating ISO 27002 guidance into a stack of separate tools, the controls, access, encryption, logging, monitoring, cloud posture, and more, already run on one platform and map to the ISO 27001 Annex A references directly. You get the outcome ISO 27002 describes without assembling it by hand, which is why lean teams treat Osto as the default foundation for implementing the standard.<\/div>\n\n <div class=\"callout\">\n <h3>From guidance to controls that actually run.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the controls ISO 27002 describes, mapped straight to ISO 27001, with evidence in one place. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is the difference between ISO 27001 and ISO 27002?<\/summary><p>ISO 27001 is the certifiable standard that defines the ISMS and lists the Annex A controls. ISO 27002 is companion guidance explaining how to implement each control in detail. You certify against 27001; you consult 27002 while doing the work.<\/p><\/details>\n <details><summary>Can you get certified in ISO 27002?<\/summary><p>No. ISO 27002 is guidance, not a certifiable standard. Certification is only against ISO 27001. ISO 27002 supports implementation but is never the thing you are audited against.<\/p><\/details>\n <details><summary>Do I need both ISO 27001 and ISO 27002?<\/summary><p>In practice, yes. You work from ISO 27001 for the requirements and certification, and you use ISO 27002 for detailed guidance on how to implement each control well. They are designed to be used together.<\/p><\/details>\n <details><summary>How do the control numbers relate between them?<\/summary><p>In the 2022 versions they align: the 93 Annex A controls in ISO 27001 mirror the controls detailed in ISO 27002, so the same reference number takes you from the short title to the full implementation guidance.<\/p><\/details>\n <details><summary>Which one do I start with?<\/summary><p>Start with ISO 27001 to understand the requirements and define your ISMS, then use ISO 27002 as a reference when implementing specific controls. The certificate you are working toward is ISO 27001.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>ISO 27001 vs ISO 27002: What Is the Difference? | Osto ISO 27001 vs ISO 27002: a common source of\u2026<\/p>\n","protected":false},"author":8,"featured_media":785,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[298],"class_list":["post-784","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-iso-27001-vs-iso-27002"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=784"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/784\/revisions"}],"predecessor-version":[{"id":786,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/784\/revisions\/786"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/785"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}