# The ISO 27000 family: which standard does what? The numbers describe different jobs, so choose the standard that answers your actual security or privacy question. The Assurance Desk. Published 9 October 2026. Last checked 9 October 2026. Part of the guide [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md). **The short answer.** The ISO 27000 family contains standards with different jobs. ISO/IEC 27001 sets requirements for managing information security. Other standards explain the concepts, controls, risks, cloud services or privacy work. The numbers are not a ladder of levels to complete ([committee.iso.org, ISO/IEC 27000:2026, Information security, cybersecurity and privacy protection, Information security management systems, Overview](https://committee.iso.org/standard/27000), [committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001), [committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls](https://committee.iso.org/standard/75652.html), [committee.iso.org, ISO/IEC 27005:2022, Guidance on managing information security risks](https://committee.iso.org/standard/80585.html), [committee.iso.org, ISO/IEC 27017:2026, Information security, cybersecurity and privacy protection, Information security controls based on ISO/IEC 27002 for cloud services](https://committee.iso.org/standard/27017), [committee.iso.org, ISO/IEC 27018:2025, Information security, cybersecurity and privacy protection, Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors](https://committee.iso.org/standard/27018) and [committee.iso.org, ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection, Privacy information management systems, Requirements and guidance](https://committee.iso.org/standard/27701), checked 9 October 2026). ## What is ISO 27000, and how does the family fit? ISO 27000 can mean the wider family or the individual overview standard. ISO/IEC 27000:2026 explains the concepts and how the related documents fit together ([committee.iso.org, ISO/IEC 27000:2026, Information security, cybersecurity and privacy protection, Information security management systems, Overview](https://committee.iso.org/standard/27000), checked 9 October 2026). An information security management system, or ISMS, is the organised approach behind this work. It brings together people, policies and technology. ISO/IEC 27001 sets its requirements ([committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001), checked 9 October 2026). **Different jobs within the same family** - **Understand the system**: Overview and management requirements. (ISO/IEC 27000 and ISO/IEC 27001.) - **Put security into practice**: Controls and risk management guidance. (ISO/IEC 27002 and ISO/IEC 27005.) - **Work with cloud services**: Cloud security and public cloud personal information. (ISO/IEC 27017 and ISO/IEC 27018.) - **Manage privacy**: Requirements for a privacy information management system. (ISO/IEC 27701.) This is a map of purposes, not a certification sequence. Privacy management has its own independent standard. Source: committee.iso.org, ISO/IEC 27000:2026, Information security, cybersecurity and privacy protection, Information security management systems, Overview, https://committee.iso.org/standard/27000 (checked 9 October 2026); committee.iso.org, ISO/IEC 27001:2022, Information security management systems, https://committee.iso.org/standard/27001 (checked 9 October 2026); committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls, https://committee.iso.org/standard/75652.html (checked 9 October 2026); committee.iso.org, ISO/IEC 27005:2022, Guidance on managing information security risks, https://committee.iso.org/standard/80585.html (checked 9 October 2026); committee.iso.org, ISO/IEC 27017:2026, Information security, cybersecurity and privacy protection, Information security controls based on ISO/IEC 27002 for cloud services, https://committee.iso.org/standard/27017 (checked 9 October 2026); committee.iso.org, ISO/IEC 27018:2025, Information security, cybersecurity and privacy protection, Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors, https://committee.iso.org/standard/27018 (checked 9 October 2026); committee.iso.org, ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection, Privacy information management systems, Requirements and guidance, https://committee.iso.org/standard/27701 (checked 9 October 2026) ## Which ISO standard does what? This table covers a useful selection, rather than every document in the family. The edition year helps identify the version being discussed. Check the catalogue for amendments as well as the base edition ([committee.iso.org, ISO/IEC 27000:2026, Information security, cybersecurity and privacy protection, Information security management systems, Overview](https://committee.iso.org/standard/27000), [committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001), [committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls](https://committee.iso.org/standard/75652.html), [committee.iso.org, ISO/IEC 27005:2022, Guidance on managing information security risks](https://committee.iso.org/standard/80585.html), [committee.iso.org, ISO/IEC 27017:2026, Information security, cybersecurity and privacy protection, Information security controls based on ISO/IEC 27002 for cloud services](https://committee.iso.org/standard/27017), [committee.iso.org, ISO/IEC 27018:2025, Information security, cybersecurity and privacy protection, Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors](https://committee.iso.org/standard/27018) and [committee.iso.org, ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection, Privacy information management systems, Requirements and guidance](https://committee.iso.org/standard/27701), checked 9 October 2026). **A practical guide to the standards and their editions** | Standard and edition | Its main job | When it helps | | --- | --- | --- | | ISO/IEC 27000:2026 | Overview of concepts and relationships. | Understanding how the family fits together. | | ISO/IEC 27001:2022 | Requirements for an information security management system. | Building the system or considering certification. | | ISO/IEC 27002:2022 | Detailed guidance on information security controls. | Choosing how to put security measures into practice. | | ISO/IEC 27005:2022 | Guidance on managing information security risks. | Identifying, assessing and treating risks. | | ISO/IEC 27017:2026 | Security controls for cloud services. | Working out customer and provider responsibilities. | | ISO/IEC 27018:2025 | Personal information in public clouds acting as processors. | Providing or assessing that type of cloud service. | | ISO/IEC 27701:2025 | Requirements and guidance for privacy management. | Managing personal information as a controller or processor. | Source: committee.iso.org, ISO/IEC 27000:2026, Information security, cybersecurity and privacy protection, Information security management systems, Overview, https://committee.iso.org/standard/27000 (checked 9 October 2026); committee.iso.org, ISO/IEC 27001:2022, Information security management systems, https://committee.iso.org/standard/27001 (checked 9 October 2026); committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls, https://committee.iso.org/standard/75652.html (checked 9 October 2026); committee.iso.org, ISO/IEC 27005:2022, Guidance on managing information security risks, https://committee.iso.org/standard/80585.html (checked 9 October 2026); committee.iso.org, ISO/IEC 27017:2026, Information security, cybersecurity and privacy protection, Information security controls based on ISO/IEC 27002 for cloud services, https://committee.iso.org/standard/27017 (checked 9 October 2026); committee.iso.org, ISO/IEC 27018:2025, Information security, cybersecurity and privacy protection, Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors, https://committee.iso.org/standard/27018 (checked 9 October 2026); committee.iso.org, ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection, Privacy information management systems, Requirements and guidance, https://committee.iso.org/standard/27701 (checked 9 October 2026) ## ISO 27001 versus ISO 27002: requirements or controls? ISO/IEC 27001 says what the management system must meet. ISO/IEC 27002 gives guidance on the controls that can operate within it. They serve different purposes ([committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001) and [committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls](https://committee.iso.org/standard/75652.html), checked 9 October 2026). Organisations can choose to seek certification to ISO/IEC 27001. ISO says ISO/IEC 27002 cannot itself be certified to. Following its guidance is different from holding a certificate to the requirements standard ([committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001) and [committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls](https://committee.iso.org/standard/75652.html), checked 9 October 2026). For a UK buyer, a useful question is: which exact standard and edition does this certificate name? Keep that separate from the list of guidance documents a supplier uses ([committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001) and [committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls](https://committee.iso.org/standard/75652.html), checked 9 October 2026). > "No, ISO/IEC 27002 provides best practice recommendations and cannot be certified to." > ISO, Information security controls > committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls, https://committee.iso.org/standard/75652.html (checked 9 October 2026) ## Where do risk and cloud standards help? ISO/IEC 27005 helps identify, assess and treat information security risks. Its guidance also covers communication, monitoring and review. Think of it as help with deciding which risks need attention and keeping that decision current ([committee.iso.org, ISO/IEC 27005:2022, Guidance on managing information security risks](https://committee.iso.org/standard/80585.html), checked 9 October 2026). ISO/IEC 27017 covers cloud security for both customers and providers. It applies to public, private and hybrid cloud environments. ISO/IEC 27018 has a narrower focus: personal information in public clouds where the provider acts as a processor ([committee.iso.org, ISO/IEC 27017:2026, Information security, cybersecurity and privacy protection, Information security controls based on ISO/IEC 27002 for cloud services](https://committee.iso.org/standard/27017) and [committee.iso.org, ISO/IEC 27018:2025, Information security, cybersecurity and privacy protection, Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors](https://committee.iso.org/standard/27018), checked 9 October 2026). The term PII means personally identifiable information. In this context, the public cloud processor handles that information for a customer. The guidance is also relevant when evaluating providers ([committee.iso.org, ISO/IEC 27018:2025, Information security, cybersecurity and privacy protection, Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors](https://committee.iso.org/standard/27018), checked 9 October 2026). **Example questions and the guidance to explore** | Your question | Relevant starting point | | --- | --- | | Which information security risks should we address? | ISO/IEC 27005 for risk assessment and treatment. | | Who handles security in our cloud arrangement? | ISO/IEC 27017 for customer and provider responsibilities. | | How does a public cloud processor protect personal information? | ISO/IEC 27018 for that specific cloud role. | Source: committee.iso.org, ISO/IEC 27005:2022, Guidance on managing information security risks, https://committee.iso.org/standard/80585.html (checked 9 October 2026); committee.iso.org, ISO/IEC 27017:2026, Information security, cybersecurity and privacy protection, Information security controls based on ISO/IEC 27002 for cloud services, https://committee.iso.org/standard/27017 (checked 9 October 2026); committee.iso.org, ISO/IEC 27018:2025, Information security, cybersecurity and privacy protection, Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors, https://committee.iso.org/standard/27018 (checked 9 October 2026) ## Is ISO 27701 still just an extension? ISO/IEC 27701:2025 is an independent management system standard. It sets requirements for a privacy information management system, or PIMS. Older descriptions that treat it only as an extension do not describe the current edition ([committee.iso.org, ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection, Privacy information management systems, Requirements and guidance](https://committee.iso.org/standard/27701), checked 9 October 2026). It is designed for controllers and processors of personal information. Its job is privacy management, which is a different focus from the general information security requirements ([committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001) and [committee.iso.org, ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection, Privacy information management systems, Requirements and guidance](https://committee.iso.org/standard/27701), checked 9 October 2026). ## What should you check before choosing a standard? Start with the job: understanding the system, managing security, choosing controls, assessing risk, working with cloud services or managing privacy. Match the document to that job ([committee.iso.org, ISO/IEC 27000:2026, Information security, cybersecurity and privacy protection, Information security management systems, Overview](https://committee.iso.org/standard/27000), [committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001), [committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls](https://committee.iso.org/standard/75652.html), [committee.iso.org, ISO/IEC 27005:2022, Guidance on managing information security risks](https://committee.iso.org/standard/80585.html), [committee.iso.org, ISO/IEC 27017:2026, Information security, cybersecurity and privacy protection, Information security controls based on ISO/IEC 27002 for cloud services](https://committee.iso.org/standard/27017), [committee.iso.org, ISO/IEC 27018:2025, Information security, cybersecurity and privacy protection, Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors](https://committee.iso.org/standard/27018) and [committee.iso.org, ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection, Privacy information management systems, Requirements and guidance](https://committee.iso.org/standard/27701), checked 9 October 2026). Check the edition too. The current ISO/IEC 27000 overview focuses on concepts and relationships, rather than acting mainly as a vocabulary document. The ISO/IEC 27001 catalogue also lists an amendment to its base edition ([committee.iso.org, ISO/IEC 27000:2026, Information security, cybersecurity and privacy protection, Information security management systems, Overview](https://committee.iso.org/standard/27000) and [committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001), checked 9 October 2026). This guide uses the public ISO catalogue descriptions to explain what each document is for. For implementation, use the relevant standard and its applicable amendments. A summary table is a starting point for choosing what to read ([committee.iso.org, ISO/IEC 27000:2026, Information security, cybersecurity and privacy protection, Information security management systems, Overview](https://committee.iso.org/standard/27000), [committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001), [committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls](https://committee.iso.org/standard/75652.html), [committee.iso.org, ISO/IEC 27005:2022, Guidance on managing information security risks](https://committee.iso.org/standard/80585.html), [committee.iso.org, ISO/IEC 27017:2026, Information security, cybersecurity and privacy protection, Information security controls based on ISO/IEC 27002 for cloud services](https://committee.iso.org/standard/27017), [committee.iso.org, ISO/IEC 27018:2025, Information security, cybersecurity and privacy protection, Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors](https://committee.iso.org/standard/27018) and [committee.iso.org, ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection, Privacy information management systems, Requirements and guidance](https://committee.iso.org/standard/27701), checked 9 October 2026). ## What to do 1. Write down the security or privacy job you need to do ([committee.iso.org, ISO/IEC 27000:2026, Information security, cybersecurity and privacy protection, Information security management systems, Overview](https://committee.iso.org/standard/27000), [committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001), [committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls](https://committee.iso.org/standard/75652.html), [committee.iso.org, ISO/IEC 27005:2022, Guidance on managing information security risks](https://committee.iso.org/standard/80585.html), [committee.iso.org, ISO/IEC 27017:2026, Information security, cybersecurity and privacy protection, Information security controls based on ISO/IEC 27002 for cloud services](https://committee.iso.org/standard/27017), [committee.iso.org, ISO/IEC 27018:2025, Information security, cybersecurity and privacy protection, Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors](https://committee.iso.org/standard/27018) and [committee.iso.org, ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection, Privacy information management systems, Requirements and guidance](https://committee.iso.org/standard/27701), checked 9 October 2026). 2. Check the exact standard, edition and applicable amendments ([committee.iso.org, ISO/IEC 27000:2026, Information security, cybersecurity and privacy protection, Information security management systems, Overview](https://committee.iso.org/standard/27000), [committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001), [committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls](https://committee.iso.org/standard/75652.html), [committee.iso.org, ISO/IEC 27005:2022, Guidance on managing information security risks](https://committee.iso.org/standard/80585.html), [committee.iso.org, ISO/IEC 27017:2026, Information security, cybersecurity and privacy protection, Information security controls based on ISO/IEC 27002 for cloud services](https://committee.iso.org/standard/27017), [committee.iso.org, ISO/IEC 27018:2025, Information security, cybersecurity and privacy protection, Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors](https://committee.iso.org/standard/27018) and [committee.iso.org, ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection, Privacy information management systems, Requirements and guidance](https://committee.iso.org/standard/27701), checked 9 October 2026). 3. Distinguish using guidance from seeking certification ([committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001) and [committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls](https://committee.iso.org/standard/75652.html), checked 9 October 2026). 4. For cloud work, identify whether you are the customer or provider and what information is involved ([committee.iso.org, ISO/IEC 27017:2026, Information security, cybersecurity and privacy protection, Information security controls based on ISO/IEC 27002 for cloud services](https://committee.iso.org/standard/27017) and [committee.iso.org, ISO/IEC 27018:2025, Information security, cybersecurity and privacy protection, Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors](https://committee.iso.org/standard/27018), checked 9 October 2026). ## Common questions ### Are ISO 27001 and ISO 27002 the same? No. ISO/IEC 27001 sets management system requirements. ISO/IEC 27002 gives controls guidance. ISO says the latter cannot itself be certified to ([committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001) and [committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls](https://committee.iso.org/standard/75652.html), checked 9 October 2026). ### Is ISO 27017 only for public cloud providers? No. It covers both cloud customers and providers, and includes public, private and hybrid environments ([committee.iso.org, ISO/IEC 27017:2026, Information security, cybersecurity and privacy protection, Information security controls based on ISO/IEC 27002 for cloud services](https://committee.iso.org/standard/27017), checked 9 October 2026). ### Must an organisation seek ISO 27001 certification? ISO says organisations implementing the standard can decide whether to seek certification. Using the standard and going through certification are separate choices ([committee.iso.org, ISO/IEC 27001:2022, Information security management systems](https://committee.iso.org/standard/27001), checked 9 October 2026). ### What does PIMS mean? It means privacy information management system. ISO/IEC 27701 sets requirements for establishing, maintaining and improving that system ([committee.iso.org, ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection, Privacy information management systems, Requirements and guidance](https://committee.iso.org/standard/27701), checked 9 October 2026). ## Where next - [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md) - [How do you check an ISO certificate is genuine?](https://theassurancedesk.com/guides/check-iso-certificate-is-genuine.md) - [ISO 27001 or SOC 2: which does your customer want?](https://theassurancedesk.com/guides/iso-27001-or-soc-2.md) - [What is supplier assurance, and what do buyers check?](https://theassurancedesk.com/guides/supplier-assurance-what-buyers-check.md) ## Sources - committee.iso.org, ISO/IEC 27000:2026, Information security, cybersecurity and privacy protection, Information security management systems, Overview: https://committee.iso.org/standard/27000 (checked 9 October 2026) - committee.iso.org, ISO/IEC 27001:2022, Information security management systems: https://committee.iso.org/standard/27001 (checked 9 October 2026) - committee.iso.org, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls: https://committee.iso.org/standard/75652.html (checked 9 October 2026) - committee.iso.org, ISO/IEC 27005:2022, Guidance on managing information security risks: https://committee.iso.org/standard/80585.html (checked 9 October 2026) - committee.iso.org, ISO/IEC 27017:2026, Information security, cybersecurity and privacy protection, Information security controls based on ISO/IEC 27002 for cloud services: https://committee.iso.org/standard/27017 (checked 9 October 2026) - committee.iso.org, ISO/IEC 27018:2025, Information security, cybersecurity and privacy protection, Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors: https://committee.iso.org/standard/27018 (checked 9 October 2026) - committee.iso.org, ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection, Privacy information management systems, Requirements and guidance: https://committee.iso.org/standard/27701 (checked 9 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.