ISO 27002
ISO 27002 is the companion standard to ISO 27001: a detailed implementation guide for the same control set that ISO 27001 lists in Annex A. It explains how each control can work in practice. You can’t certify against ISO 27002 — certification always happens against ISO 27001.
The companion standard to ISO 27001 that provides detailed implementation guidance for each information security control; organizations certify against ISO 27001, while ISO 27002 serves as the reference for how controls can be implemented.
ISO 27002.
Glossary · ISO 27002Two standards, one control set
ISO 27001 defines the management system and lists its reference controls in Annex A — each in a sentence or two. ISO 27002 takes that same catalog and expands every control into pages of guidance: purpose, implementation advice, and attributes for filtering controls by type or security property. The numbering tracks between the two documents, which is why practitioners read them side by side.
Certifiable versus consultable
The division of labor is strict. ISO 27001 contains requirements — auditable “shall” statements — so it’s the standard a certification body audits against. ISO 27002 contains guidance, not requirements, so there is no such thing as an ISO 27002 certificate; a vendor claiming one is, at best, describing alignment. When a security questionnaire asks which standard you certify to, the answer is always 27001.
How to actually use it
Treat 27002 as the implementer’s manual: when your Statement of Applicability marks a control applicable, 27002 shows what a credible implementation looks like before you invent one from scratch. It’s especially useful for startups translating terse control names into concrete engineering and process decisions without over-building.
Glossary
Guidance turned into an operating program
Agency’s engineers translate control guidance into configurations, policies, and routines your auditor can verify. 500+ programs delivered. Rated 4.9 out of 5 stars on G2.
Platform Products
Agency AIEnd-to-end cybersecurity and compliance, across the stack you already use.GRC IntegrationsEngineer-operated GRC platform integrationAuditsuisse AIAI-powered evidence collection and analysis for IT audits.Find your auditor
Auditnex makes buying audits simpler and more transparent.
Agency implements the controls, collects the evidence, and manages your auditor relationship on top of the GRC tools you already use.
Explore AuditnexCommon GRC Questions
GRC Platform & Virtual CISO FAQ
The long-form FAQ on how managed GRC and virtual CISO coverage work together.
Read the FAQMore from Agency
See it on the home pageBuild a Security & Compliance Team Led by Your Own Virtual CISO
Forward-Deployed Engineers + AI that lower costs, increase velocity, and raise the bar — from policy to audit to remediation. U.S.-based forward-deployed engineers, supercharged by proprietary AI, operate your program end-to-end — on top of the tools you already trust.