The ISO 27000 Family: Which Standard Does What

ISO/IEC 27001 is the standard an organisation’s ISMS is certified against. Most of the rest of the family is guidance: 27002 for implementing the controls, 27005 for the risks, 27003 and 27004 for building and measuring the system, 27007 for auditing it. Two state requirements rather than guidance — one binding certification bodies, one certifying a different management system.

The ISO 27000 family: the distinction that matters most

One standard in the family states the requirements an ISMS is certified against, and most of the rest give guidance. The difference is not a matter of importance — it decides what can appear in a finding.

Two standards in the family state requirements rather than guidance, and neither is a rival to ISO/IEC 27001. ISO/IEC 27006-1 binds certification bodies rather than the organisations they certify. ISO/IEC 27701 certifies a different management system — privacy rather than information security. Only one standard in the range certifies an ISMS.

Audit criteria for an ISMS certification audit are ISO/IEC 27001, the organisation’s own documented information, and applicable legal and contractual requirements. Guidance standards are not criteria. An organisation that implements a control differently from the way ISO/IEC 27002 suggests has not breached anything, and a nonconformity written against a guidance standard will not survive being argued with.

This is worth holding firmly, because guidance standards are genuinely useful and the temptation to cite them is real.

The ISO 27000 family map

Two standards an auditor needs sit outside the 27000 range entirely: ISO 19011 for how any management system audit is conducted, and ISO/IEC 17021-1 for what a certification body must do.

A warning about ISO/IEC 27000 itself

This one has changed in a way that catches people, and it is the reason this page exists in the form it does.

ISO/IEC 27000 used to be the family’s vocabulary standard — the place the precise definitions lived. It is now an overview document. Its terms clause has been cut back to the handful of terms it needs to explain its own contents, and it states that it is no longer a terminology document.

The practical consequences are direct. Definitions of risk, control, threat, vulnerability and risk owner are not in its terms clause. They are in ISO/IEC 27005, which defines all five in its own terms clause, and behind that in the general risk management standard the family draws on.

Meanwhile a great deal of published material, training material included, still cites ISO/IEC 27000 for definitions it no longer carries, or quotes wordings from superseded editions. Integrity is the example that matters most. The current definition is short — the property of accuracy and completeness. The version most people quote adds words about safeguarding against unauthorised modification, and comes from an edition long withdrawn. What that changes in an audit is a subject of its own.

One loose end worth knowing about rather than tidying away: ISO/IEC 27001’s own terms clause still points at ISO/IEC 27000 for its definitions, and several of the terms it needs are no longer there. In practice you follow the family to ISO/IEC 27005 and quote the definition you find, which is what an examiner will expect.

If you are checking a definition, check which document currently carries it before you rely on the wording.

Why the ISO 27000 numbering looks arbitrary

It is not quite arbitrary, and knowing the pattern makes the range easier to navigate.

• 27000 to 27009 are the core: the overview, the requirements standard, and the guidance documents that support them — implementation, measurement, risk, certification-body requirements, auditing.
• 27010 upwards are sector and context variants, mostly building on ISO/IEC 27002’s controls for a particular setting — cloud services, personal data in public clouds, telecommunications and energy utilities among them.
• 27700 upwards is where the range stops being purely about information security. ISO/IEC 27701 covers privacy management; ISO 27799 covers health informatics. The block is less tidy than the two below it, so treat the pattern as a rough guide rather than a rule.

The consequence for a reader is a useful heuristic: a number in the 27000s that you have not met before is most likely guidance for a sector or a technology, not a new requirement you have missed.

The ISO 27000 standards that govern how the audit is run

Both sit outside the 27000 range and both are worth understanding properly, because they explain why a certification audit behaves as it does.

ISO 19011 is guidance on auditing any management system. It covers the audit principles, managing an audit programme, conducting an audit from initiation to follow-up, and the competence and evaluation of auditors. It applies to internal audits, supplier audits and certification audits alike, and it is the standard a lead auditor’s technique is built on.

ISO/IEC 17021-1 is a requirements standard, but the requirements fall on certification bodies rather than on the organisations they certify. It is where the two-stage initial audit comes from, where the independence of the certification decision comes from, and where the impartiality rules that stop a body certifying a system it helped design come from.

Two things follow that candidates are tested on. An organisation cannot be nonconforming against ISO/IEC 17021-1 — it is not their standard, and a finding written against it is misdirected. And the audit team’s inability to promise certification is a 17021-1 requirement, not the team being cautious.

ISO/IEC 27006-1 does the same job specifically for bodies certifying ISMSs, and adds the ISMS-specific parts. The most visible is how audit time is determined: it starts from the effective number of personnel — a count that treats people doing identical work as one rather than individually — and is then adjusted for the complexity of the ISMS. Revenue does not come into it.

Which ISO 27000 standards you would ever buy

Standards cost money and most people over-buy. A realistic answer, by role.

If you are training as a lead auditor: ISO/IEC 27001, and ISO 19011. Those two do almost all the work. ISO/IEC 27002 is worth having because it tells you what a control is for, which makes it much easier to judge whether an organisation’s version of it is credible.

If you are auditing for a certification body: add ISO/IEC 17021-1 and ISO/IEC 27006-1. These are the rules you personally operate under, including how audit time is determined.

If you are implementing: ISO/IEC 27001 and 27002, with 27003 if the requirements are unfamiliar and 27005 if the risk process is what you are building.

If your organisation is a cloud provider or processes personal data at scale: 27017 and 27018 respectively become useful, and 27701 if privacy is being managed as a system rather than a compliance exercise.

What you may take into the examination is a separate question, and the answer is set by the awarding body and your training provider rather than by what you own. In short: plan around a clean copy of ISO/IEC 27001, and get the rest confirmed in writing before the day. What may and may not be in the room sets out where the published guidance agrees and where it does not.

How the ISO 27000 standards relate to each other

Three relationships explain most of the family.

27001 requires; 27002 explains. Annex A gives 93 control titles and a sentence each. ISO/IEC 27002 gives the purpose, guidance and other information for every one of them. An auditor who wants to know whether a control has been implemented sensibly, rather than merely implemented, reads 27002 — and then audits against 27001.

27001 requires a risk process; 27005 describes how to run one. This is where the four treatment options come from. ISO/IEC 27001 itself requires the organisation to select appropriate options and does not list them.

19011 is general; 27007 is specific; 17021-1 and 27006-1 govern certification bodies. ISO 19011 covers auditing any management system. ISO/IEC 27007 adds ISMS-specific guidance on top. The certification-body standards are a different kind of document altogether, and one precedence rule follows: on a third-party certification audit, the certification-body requirements take precedence over the general guidance in ISO 19011 where the two differ.

What an ISO 27001 auditor does with the guidance standards

The rule is that guidance is not criteria. That leaves a real question: if you cannot cite it, what is it for?

It tells you what “good” looks like, so you can tell when something is not. An auditor who has read the implementation guidance for a control knows what it is trying to achieve, which makes it much easier to judge whether an organisation’s version does that or merely resembles it. A logging arrangement that captures events nobody can search is technically a logging arrangement. Knowing what the control is for is how you notice.

It gives you the question, not the finding. Guidance suggests a way of doing something; the organisation has done it differently; the auditor asks how the organisation’s way achieves the outcome. Often it does, and there is nothing to raise. Sometimes the answer reveals that nobody had thought about the outcome at all — and that is citeable, against the requirement.

It is where an organisation’s own criteria can come from. This is the part people miss. If an organisation states in its own documented information that it follows a guidance standard, that guidance becomes part of the audit criteria for that organisation — not because the guidance says so, but because an ISMS is audited against the organisation’s own requirements as well as against ISO/IEC 27001. Clause 9.2.1 says so for internal audit, and the definition of audit criteria says so generally. An ISMS manual that says “controls are implemented in accordance with ISO/IEC 27002” has raised its own bar, and it is fair to hold it there.

Frequently asked questions about the ISO 27000 family of standards

Where to go next: more ISO 27001 Lead Auditor exam preparation

• ISO/IEC 27001 clauses 4 to 10, clause by clause
• All 93 Annex A controls, by theme
• The Statement of Applicability, and how it is audited
• How plan-do-check-act maps onto the clauses

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is PR373. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.