ISO 27000 series

The series is maintained by the joint ISO/IEC committee JTC 1/SC 27 (Information security, cybersecurity and privacy protection), and the distinction that matters most is between requirements standards, written with "shall" and usable for certification, and guidance standards, written with "should". ISO/IEC 27001 is the central requirements standard; ISO/IEC 27006 sets requirements for the bodies that certify against it; and since its 2025 edition ISO/IEC 27701 is a standalone, certifiable privacy information management system rather than an extension of 27001. ISO/IEC 27000 supplies the overview and vocabulary and is a normative reference of 27001, so terms such as "risk owner", "control" and "nonconformity" carry their 27000 meaning in an audit.

The guidance layer is large. ISO/IEC 27002 describes the controls, 27003 explains how to implement the ISMS clauses, 27004 covers monitoring, measurement and evaluation, 27005 covers information security risk management, and 27007 and 27008 guide auditors of the management system and of the controls respectively. Sector and topic documents build on the same control structure: 27017 for cloud services, 27018 for processors of personal data in public clouds, 27019 for the energy utility industry, 27011 for telecommunications and ISO 27799 for health informatics, alongside topic standards such as 27031 (ICT readiness for business continuity), the 27035 parts on incident management and the 27036 parts on supplier relationships.

The lineage explains the numbering. British Standard BS 7799 Part 1 (1995) became ISO/IEC 17799 in 2000 and was renumbered ISO/IEC 27002 in 2007; BS 7799-2 became ISO/IEC 27001:2005. The 2013 revision moved 27001 onto the common structure for ISO management system standards, and the 2022 revision reorganised the controls into four themes, followed by a 2024 amendment adding climate change to the context clauses.

Common misconceptions: there is no such thing as being "ISO 27000 certified", and 27002 cannot be certified against; extensions such as 27017 and 27018 are normally assessed as additions to a 27001 certificate rather than as certificates of their own. The documents are copyrighted and sold by ISO and national bodies, which is one reason freely available frameworks such as the NIST CSF and the CIS Controls are often used alongside them. When comparing the two worlds, the NIST CSF lists ISO/IEC 27001 controls among its informative references, so the frameworks can be mapped rather than chosen between.