ISO 27000 Family Explained ✓ ISO 27001 vs 27002, 27003, 27004 & 27005

When companies first encounter ISO 27001, they often assume there is one standard to read, implement, and certify against. Then they discover ISO 27002, ISO 27003, ISO 27004, ISO 27005, ISO 27017 and several other numbers—and suddenly information security starts looking like a very expensive phone directory.

The good news is that you do not need to implement every ISO/IEC 27000-series standard to achieve ISO 27001 certification.

ISO/IEC 27001 is the central certification standard. The other members of the family play supporting roles: some explain controls, some help manage information security risks, some improve measurement and auditing, and others address specific areas such as cloud security and privacy.

In this guide, I will provide the ISO 27000 family explained from a practical business perspective and show which ISO 27001 related standards are most useful before, during, and after certification.

What Is the ISO/IEC 27000 Family?

The ISO/IEC 27000 family is a group of international standards covering information security management, cybersecurity, privacy protection, risk management, security controls, auditing, measurement, and specialized security topics.

At the center of the family is ISO/IEC 27001:2022, the internationally recognized requirements standard for an Information Security Management System, or ISMS. ISO describes it as the best-known standard for information security management systems.

Think of the family as a toolkit.

ISO 27001 tells you what your management system must achieve. Other standards help explain how you can achieve it effectively.

This distinction matters because organizations sometimes create unnecessary complexity by trying to “comply with the entire 27000 family.” That is not how ISO 27001 certification works.

For most organizations, the standards can be grouped into several practical roles:

ISO/IEC 27001 — requirements for the ISMS and the standard against which certification is performed.
ISO/IEC 27002 — detailed guidance on information security controls.
ISO/IEC 27003 — guidance on implementing an ISMS.
ISO/IEC 27004 — guidance on monitoring, measurement, analysis, and evaluation.
ISO/IEC 27005 — guidance on information security risk management.
ISO/IEC 27006-1 — requirements affecting bodies that audit and certify ISMSs.
Other standards address cloud security, privacy, sector-specific requirements, security governance, and related topics.

You normally select supporting standards according to your organization’s risks, services, customers, regulatory environment, and maturity. A SaaS provider processing personal data in several jurisdictions, for example, may need a different combination than a manufacturing company operating primarily on internal infrastructure.

ISO 27001: The Standard You Actually Certify Against

This is the most important point in the entire article:

Organizations obtain certification against ISO/IEC 27001—not against the ISO/IEC 27000 family as a whole.

ISO/IEC 27001:2022 specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS.

It requires organizations to think systematically about issues such as:

organizational context and interested parties;
information security risks and opportunities;
leadership responsibilities;
information security objectives;
resources and competence;
operational risk assessment and treatment;
monitoring and measurement;
internal audits;
management review;
corrective action and continual improvement.

This is why ISO 27001 should not be treated as simply a cybersecurity checklist.

You can have excellent firewalls, multi-factor authentication, endpoint protection, backups, and penetration testing and still have a weak ISMS. Certification is about demonstrating that information security is managed as a repeatable business system, not that somebody purchased enough security products.

For technology companies, this distinction is particularly valuable. I discuss the commercial side of that approach in ISO 27001 for SaaS, IT, and Consulting Companies: Turning Trust into a Business Asset.

ISO 27001 vs ISO 27002: The Difference That Causes the Most Confusion

The ISO 27001 vs ISO 27002 question comes up in almost every certification project.

The simplest explanation is:

ISO 27001 contains requirements. ISO 27002 contains implementation guidance for information security controls.

ISO/IEC 27002:2022 provides guidance and best practices for information security controls, while ISO 27001 defines the requirements of the ISMS itself.

ISO 27001:2022 Annex A contains 93 reference controls grouped into four themes:

organizational;
people;
physical;
technological.

ISO 27002 goes considerably deeper into what these controls mean and how organizations can approach them.

For example, ISO 27001 may establish the control reference relevant to access rights. ISO 27002 helps practitioners understand how such a control can be interpreted and implemented.

But there is another important point: you are not supposed to blindly implement all controls simply because they appear in Annex A.

The organization first assesses its risks. It then determines appropriate risk treatment and identifies necessary controls. Annex A is used as an important reference to ensure that relevant controls have not been overlooked.

That logic eventually feeds into the Statement of Applicability, one of the documents auditors pay close attention to.

In other words, ISO 27002 is extremely useful, but buying a copy and implementing every recommendation from top to bottom is not automatically an ISO 27001 implementation strategy. Security controls should follow business context and risk—not the other way around.

ISO 27003: Guidance for Building the ISMS

ISO/IEC 27003 is intended to provide guidance on information security management system implementation.

It is especially useful when an organization understands the requirements of ISO 27001 but struggles with translating clauses such as “context,” “planning,” or “support” into an actual management system.

This happens frequently.

A company reads ISO 27001 and understands every individual sentence. But when I ask, “How does information security risk connect to objectives, controls, monitoring, internal audit, and management review?” the room becomes considerably quieter.

ISO 27003 helps provide structure around implementation.

There is one important practical caveat. The currently published ISO/IEC 27003:2017 was written to explain ISO/IEC 27001:2013, and ISO is developing a replacement edition.

So I would use ISO 27003 as supporting implementation guidance, but always keep ISO/IEC 27001:2022 itself as the authoritative reference for current certification requirements.

ISO 27004: How Do You Know Your ISMS Is Working?

One of the biggest mistakes in ISO implementation is confusing activity with effectiveness.

Consider statements such as:

“We trained 100% of employees.”

“We installed endpoint protection.”

“We completed 12 vulnerability scans.”

Excellent. But did security performance actually improve?

That is the territory of ISO/IEC 27004.

The standard provides guidance on monitoring, measurement, analysis, and evaluation of information security performance and ISMS effectiveness.

Useful measurements might include:

phishing simulation results;
time required to remove access after employee termination;
percentage of critical vulnerabilities remediated within target deadlines;
security incident response times;
backup restoration success rates;
percentage of high-risk suppliers assessed;
completion and effectiveness of security awareness activities;
repeated nonconformities or recurring incidents.

The objective is not to create a dashboard with 48 colorful indicators nobody reads.

Choose measurements that help management answer meaningful questions: Are our controls working? Are our risks changing? Are we meeting our objectives? Where should we invest next?

That is much more useful during an ISO 27001 certification audit than presenting a spreadsheet simply because “ISO asked us to have KPIs.”

ISO/IEC 27004:2016 remains published, while a revised edition is under development.

ISO 27005: Risk Management Behind ISO 27001

If I had to select one supporting standard alongside ISO 27002 for a serious ISO 27001 implementation, ISO/IEC 27005 would be high on the list.

ISO 27001 is fundamentally risk-based.

Organizations must understand information security risks, determine how they will be treated, select appropriate controls, and evaluate whether the treatment remains effective.

ISO/IEC 27005:2022 provides guidance across the information security risk management cycle, including assessment, treatment, communication, monitoring, and review.

This makes it particularly helpful when designing a repeatable methodology for questions such as:

What are we protecting?

Customer data? Intellectual property? Source code? Employee information? Payment information? Cloud infrastructure?

What can happen to it?

Unauthorized disclosure? Manipulation? Loss? Service interruption? Credential compromise? Supplier failure?

How serious would that be?

Consider financial impact, contractual consequences, regulatory exposure, business interruption, reputation, and customer relationships.

How likely is it?

Not with false mathematical precision, but with a method consistent enough to support decisions.

What will we do about it?

Reduce the risk, avoid it, share or transfer it, or retain it under defined conditions.

When risk management is done well, your controls become easier to justify. When risk management is weak, an ISMS tends to become a large collection of policies searching for a reason to exist.

ISO 27003, 27004, 27005: How They Work Together

Because ISO 27003 27004 27005 is one of the areas organizations frequently search for, it is worth looking at the three as a sequence rather than isolated documents.

Imagine that ISO 27001 defines your destination.

ISO 27003 helps you build the vehicle.
ISO 27005 helps you decide where the dangerous roads are.
ISO 27004 helps determine whether the vehicle is actually performing properly.

The analogy is simplified, but the relationship is useful.

In practical ISMS work:

ISO 27003 supports implementation.

ISO 27005 strengthens risk-based decision-making.

ISO 27004 strengthens performance evaluation and continual improvement.

None replaces ISO 27001, but each can make implementation more mature and less dependent on improvisation.

What About ISO 27006-1 and the Certification Audit?

ISO/IEC 27006-1 is different because it is primarily relevant to certification bodies rather than companies implementing an ISMS.

ISO/IEC 27006-1:2024 specifies additional requirements for bodies performing ISMS audit and certification against ISO/IEC 27001, complementing the broader requirements applicable to management-system certification bodies.

Why should a company preparing for an ISO 27001 certification audit care?

Because certification is not supposed to be an improvised inspection where each auditor invents a different rulebook.

Competence, consistency, impartiality, audit processes, and certification decisions are governed within an international conformity-assessment framework.

For the organization seeking certification, however, the main implementation target remains ISO 27001.

Other ISO 27000 Standards Worth Knowing

Once the core ISMS is in place, additional standards can provide useful specialist guidance.

The right selection depends heavily on what your company actually does.

ISO/IEC 27017 — Cloud Security

ISO 27017 provides additional guidance for security controls related to cloud services and is particularly relevant to cloud service providers and cloud customers.

For SaaS companies, hosting providers, managed service companies, and businesses heavily dependent on public cloud infrastructure, cloud-specific guidance can make an ISO 27001 implementation more relevant to the real environment.

ISO/IEC 27018 — Protection of Personal Data in Public Clouds

ISO 27018 addresses protection of personally identifiable information in public cloud environments.

It can be particularly relevant when customer contracts, privacy requirements, or the company’s business model involve processing significant volumes of personal information in cloud services.

ISO/IEC 27701 — Privacy Information Management

ISO 27701 extends the conversation beyond information security into privacy information management.

That distinction matters.

Information can be secure while still being processed inappropriately from a privacy perspective. Encryption does not automatically answer questions such as why personal information is collected, how long it is retained, or which parties are allowed to process it.

For organizations operating across the EU, UK, US, Middle East, and other jurisdictions, the relationship between cybersecurity and privacy increasingly deserves management-level attention.

Do You Need All These Standards for ISO 27001 Certification?

No.

This is where organizations can save considerable time.

To pursue accredited ISO 27001 certification, your ISMS needs to conform to the applicable ISO/IEC 27001 requirements. Supporting standards are tools—not additional mandatory certification projects simply because their numbers begin with “270.”

A sensible starting combination for many organizations is:

ISO/IEC 27001 as the requirements baseline;
ISO/IEC 27002 when interpreting and implementing controls;
ISO/IEC 27005 when developing the risk management approach;
additional guidance where your business model creates a genuine need.

After that, add standards because they solve a problem—not because collecting ISO documents has somehow become the company hobby.

For a startup, this distinction is particularly important. A young company rarely benefits from recreating the governance structure of a multinational bank. It needs a proportionate ISMS that controls real risks and can scale.

I explore this approach in more detail in ISO 27001 for Startups: A Lean Security Framework That Builds Customer Trust.

What an ISO 27001 Certification Audit Actually Looks For

An auditor is not simply checking whether you have created the correct number of policies.

The audit is designed to determine whether the ISMS conforms to the standard and whether it is operating effectively.

This means evidence matters.

If your policy says access is reviewed periodically, the auditor may want to see evidence of access reviews.

If your risk treatment plan says backups reduce an availability risk, evidence that backups exist is useful—but evidence that restoration has been tested is considerably stronger.

If management has approved information security objectives, the auditor may examine whether they are monitored and whether management actually reviews their performance.

That is the difference between documentation for certification and a functioning management system.

A perfectly formatted policy that nobody follows is not mature information security. It is office decoration.

ISO 27001 or SOC 2 for International Business?

Organizations selling technology or professional services internationally often encounter another question: should we pursue ISO 27001, SOC 2, or both?

The answer depends heavily on customer expectations and target markets.

ISO 27001 has strong international recognition and works particularly well when organizations operate across multiple regions or sell into global supply chains. SOC 2 is especially common in North American technology procurement.

The frameworks overlap in several practical areas, but their structures, assurance models, and market expectations are different.

If international customers are already asking you this question during procurement, I recommend reading ISO 27001 vs SOC 2: What International Clients Expect.

The decision should start with your commercial environment—not with whichever acronym appeared first in a competitor’s website footer.

Which ISO 27000 Standards Should Your Organization Use?

I usually recommend starting with five questions:

1. Are you pursuing certification?
If yes, ISO 27001 is your core requirements standard.

2. Do you need help interpreting controls?
Use ISO 27002.

3. Is risk assessment inconsistent or overly subjective?
ISO 27005 can strengthen your methodology.

4. Are you struggling to measure ISMS effectiveness?
Look at ISO 27004.

5. Do cloud, privacy, or sector-specific risks dominate your environment?
Consider the specialized standards relevant to those areas.

That approach is much more efficient than beginning with a list of every standard in the family and trying to find a use for each one.

The certificate is important, particularly for tenders, enterprise sales, supply-chain requirements, and international expansion—but the real return comes when the ISMS makes security decisions more consistent.