About this question
What is the difference between ISO 27001 and ISO 27002? Are they related to each other or not?
What is the difference between ISO 27001 and ISO 27002? Are they related to each other or not?
Log in to share your answer and help other learners.
Log in to answerBest Answer · By JanBask Cyber Security Expert
Answered on Apr 6, 2022
ISO 27001 vs 27002 ISO 27001 establishes requirements. If an organisation wants to certify its Information Security Management System (ISMS) it needs to comply with all requirements in ISO 27001. On the other hand, ISO 27002 are best practises that are not mandatory. That means that an organisation does not need to comply with ISO 27002 but can use it as inspiration to implement requirements in ISO 27001.
For example, in ISO 27001 you have a control that requires the organisation to do backups and in ISO 27002 you have the same control but more developed, saying that the backups should be done at planned intervals, that they should be tested, that you should backup data and software, etc. ISO 27002 is more complex and difficult to comply with but it is not mandatory because depending on the context and the business of the organisation it could implement the control in another way. ISO 27001 establishes what you have to do but not how. ISO 27002 describes how.
Free tutorials and interview questions from industry experts — learn the skill, then get ready to prove it.
Step-by-step Cyber Security guides from industry experts
Common Cyber Security interview questions, answered
Guides, tips and career advice on Cyber Security from JanBask experts.
Cyber Security Ethical Hacker Roles and Responsibilities: What Do Ethical Hackers Actually Do?
What does an ethical hacker actually do? See the five-phase process, daily tasks, required skills, and where ethical hackers work.
Cyber Security Penetration Tester Roles and Responsibilities: What Does a Pen Tester Do?
Learn what a penetration tester does, including key roles, responsibilities, daily tasks, tools, skills, reporting, and…
Cyber Security GRC Analyst Roles and Responsibilities: What Does a GRC Analyst Do?
What does a GRC analyst actually do? See the core responsibilities, how they grow by experience level, a daily routine, tools,…
Cyber Security SOC Analyst Roles and Responsibilities: What Does a SOC Analyst Do?
What does a SOC analyst actually do? Explore core responsibilities, the Tier 1–3 structure, daily tasks, tools, and skills in…