{"id":192877,"date":"2026-06-19T13:59:36","date_gmt":"2026-06-19T11:59:36","guid":{"rendered":"https:\/\/factorialhr.com\/blog\/?p=192877"},"modified":"2026-06-19T14:26:24","modified_gmt":"2026-06-19T12:26:24","slug":"iso-27001-vs-iso-27002","status":"publish","type":"post","link":"https:\/\/factorialhr.com\/blog\/iso-27001-vs-iso-27002\/","title":{"rendered":"ISO 27001 vs. ISO 27002: What’s the Difference?"},"content":{"rendered":"

If your company is dipping its toes into information security for the first time, you’ve almost certainly come across the ISO 27001<\/strong> standard. And right alongside it, you’ve probably bumped into another standard with a suspiciously similar name: ISO 27002<\/strong>. Are they the same thing? Does one replace the other? Do you need to implement both?<\/p>\n

The confusion makes sense. Both belong to the same ISO\/IEC 27000 family, they share the same broad goal\u2014protecting an organization’s information\u2014and their controls even use the same numbering. But they aren’t equivalent or interchangeable, and each plays a distinct role within an Information Security Management System (ISMS).<\/p>\n

In this article, we’ll walk through what each one is, how they differ, and how they fit together<\/strong>, so you know exactly what role each standard plays in your compliance strategy.<\/p>\n

What is ISO 27001?<\/h2>\n

ISO 27001<\/a> (officially ISO\/IEC 27001) is the international standard that sets the requirements for building, maintaining, and improving an Information Security Management System (ISMS)<\/strong>. Its first version dates back to 2005, and the latest update landed in October 2022. It’s the most widely recognized reference in the field, with a presence in more than 150 countries.<\/p>\n

What really sets it apart from the other standards in the family is that it’s certifiable. Any organization, regardless of size or industry, can go through an external audit performed by an accredited body and earn an official certificate with international validity<\/strong>. That certificate is good for three years, with annual surveillance audits along the way.<\/p>\n

The standard is split into two parts. On one side are the mandatory clauses<\/strong> (4 through 10), which define how to build and run the ISMS. On the other is Annex A<\/strong>, which lists 93 security controls grouped into four categories. You don’t have to apply all of these controls\u2014each organization documents which ones apply and which don’t in its Statement of Applicability (SoA).<\/p>\n

It’s also the usual jumping-off point for tackling other frameworks like SOC 2<\/strong>, HIPAA<\/strong>, or state privacy laws such as the CCPA, since it shares a good chunk of the same risk management and security principles.<\/p>\n

ISO 27001 key takeaways<\/h3>\n