Field of Application, Usage, and Compliance

What this section is about

This topic explains who the guide is for, how ISO/IEC 27001 and ISO/IEC 27002 relate to each other, and what it means to claim compliance with ISO/IEC 27001.

The main audience includes people involved in:

• designing, implementing, or maintaining an Information Security Management System;
• preparing for ISMS audits and assessments;
• carrying out internal ISMS audits;
• auditing or assessing other organizations.

ISO/IEC 27001 vs ISO/IEC 27002

ISO/IEC 27001 tells you what the ISMS must satisfy.

ISO/IEC 27002 helps explain how controls may be implemented.

Compliance with ISO/IEC 27001

To claim compliance, an organization needs to show that:

• required ISMS processes are in place;
• objective evidence supports the compliance claim;
• information security risks have been assessed;
• risk treatment decisions have been made and documented;
• selected controls are justified;
• controls excluded or marked not applicable are justified;
• residual risks have been knowingly accepted by accountable management.

A compliance claim is not based on intention. It needs evidence.

Key rule

Excluding any of the requirements specified in Clauses 4-10 of ISO/IEC 27001 is not acceptable.

This means an organization cannot remove mandatory ISMS requirements such as:

• defining the ISMS context and scope;
• demonstrating leadership commitment;
• planning risk assessment and treatment;
• providing resources and documented information;
• operating the ISMS;
• evaluating ISMS performance;
• conducting internal audits;
• conducting management reviews;
• managing nonconformities and improvement.

See ISO 27001 Clauses 4-10 vs Annex A.

Annex A controls are different

Annex A controls are selected through risk assessment and risk treatment. A control can be marked not applicable, but only when the decision is justified and documented in the Statement of Applicability.

That is different from Clauses 4-10, which are mandatory ISMS management-system requirements.

Internal audit is mandatory

Even if the organization does not pursue third-party certification, an internal ISMS audit process is mandatory for ISO/IEC 27001 compliance.

The organization may choose not to seek certification, but it cannot claim conformity while skipping the internal audit requirement.

Practical mentor note

Do not confuse these three things:

Audit perspective

An auditor will expect the organization to provide objective evidence for claims, including:

• ISMS scope;
• policies;
• risk assessment methodology and results;
• risk treatment plan;
• Statement of Applicability;
• internal audit records;
• management review records;
• evidence of control operation;
• nonconformity and corrective action records;
• risk acceptance approvals.

Common failures

Exam traps

• Trap: “An organization can exclude ISO 27001 requirements that do not apply.”
  Correction: Clauses 4-10 cannot be excluded.

• Trap: “Annex A controls are all mandatory for certification.”
  Correction: Annex A controls are selected based on risk and justified through the SoA.

• Trap: “Third-party certification is required to be compliant.”
  Correction: Third-party certification may not be required, but internal audit is mandatory.

• Trap: “ISO 27002 is the certifiable standard.”
  Correction: ISO 27001 is certifiable; ISO 27002 is guidance.

KB-ready summary

ISO/IEC 27001 defines the requirements for an ISMS and is used for compliance and certification. ISO/IEC 27002 provides guidance for implementing controls. Clauses 4-10 of ISO/IEC 27001 are mandatory and cannot be excluded. Annex A controls are risk-based and may be excluded only with documented justification in the Statement of Applicability. Objective evidence is required to support compliance claims.