The ISO 27000 family: which standard does what?

Part of the guide What does ISO 27001 certification take, and who can certify you?

What is ISO 27000, and how does the family fit?

ISO 27000 can mean the wider family or the individual overview standard. ISO/IEC 27000:2026 explains the concepts and how the related documents fit together.

An information security management system, or ISMS, is the organised approach behind this work. It brings together people, policies and technology. ISO/IEC 27001 sets its requirements.

Which ISO standard does what?

This table covers a useful selection, rather than every document in the family. The edition year helps identify the version being discussed. Check the catalogue for amendments as well as the base edition.

ISO 27001 versus ISO 27002: requirements or controls?

ISO/IEC 27001 says what the management system must meet. ISO/IEC 27002 gives guidance on the controls that can operate within it. They serve different purposes.

Organisations can choose to seek certification to ISO/IEC 27001. ISO says ISO/IEC 27002 cannot itself be certified to. Following its guidance is different from holding a certificate to the requirements standard.

For a UK buyer, a useful question is: which exact standard and edition does this certificate name? Keep that separate from the list of guidance documents a supplier uses.

Where do risk and cloud standards help?

ISO/IEC 27005 helps identify, assess and treat information security risks. Its guidance also covers communication, monitoring and review. Think of it as help with deciding which risks need attention and keeping that decision current.

ISO/IEC 27017 covers cloud security for both customers and providers. It applies to public, private and hybrid cloud environments. ISO/IEC 27018 has a narrower focus: personal information in public clouds where the provider acts as a processor.

The term PII means personally identifiable information. In this context, the public cloud processor handles that information for a customer. The guidance is also relevant when evaluating providers.

Is ISO 27701 still just an extension?

ISO/IEC 27701:2025 is an independent management system standard. It sets requirements for a privacy information management system, or PIMS. Older descriptions that treat it only as an extension do not describe the current edition.

It is designed for controllers and processors of personal information. Its job is privacy management, which is a different focus from the general information security requirements.

What should you check before choosing a standard?

Start with the job: understanding the system, managing security, choosing controls, assessing risk, working with cloud services or managing privacy. Match the document to that job.

Check the edition too. The current ISO/IEC 27000 overview focuses on concepts and relationships, rather than acting mainly as a vocabulary document. The ISO/IEC 27001 catalogue also lists an amendment to its base edition.

This guide uses the public ISO catalogue descriptions to explain what each document is for. For implementation, use the relevant standard and its applicable amendments. A summary table is a starting point for choosing what to read.

What to do

1. Write down the security or privacy job you need to do.
2. Check the exact standard, edition and applicable amendments.
3. Distinguish using guidance from seeking certification.
4. For cloud work, identify whether you are the customer or provider and what information is involved.

Common questions

Are ISO 27001 and ISO 27002 the same?

No. ISO/IEC 27001 sets management system requirements. ISO/IEC 27002 gives controls guidance. ISO says the latter cannot itself be certified to.

Is ISO 27017 only for public cloud providers?

No. It covers both cloud customers and providers, and includes public, private and hybrid environments.

Must an organisation seek ISO 27001 certification?

ISO says organisations implementing the standard can decide whether to seek certification. Using the standard and going through certification are separate choices.

What does PIMS mean?

It means privacy information management system. ISO/IEC 27701 sets requirements for establishing, maintaining and improving that system.

Where next

• What does ISO 27001 certification take, and who can certify you?
• How do you check an ISO certificate is genuine?
• ISO 27001 or SOC 2: which does your customer want?
• What is supplier assurance, and what do buyers check?

This is an independent editorial guide, not legal advice.