Tidal Control incident
ISO 27001 vs ISO 27002: what's the difference and what do you need
Resolved on February 23, 2026.
ISO 27001 is the certifiable standard containing the requirements for an information security management system, and it is the one in the ISO 27000 family an organisation certifies its ISMS against. ISO 27002 is a non-certifiable guideline that provides detailed implementation guidance for the same 93 controls listed in Annex A of ISO 27001. An auditor assesses your ISMS against ISO 27001, not against ISO 27002. Using ISO 27002 is a choice, not an obligation.
Update timeline
- resolved Feb 23, 2026, 12:00 AM UTC
ISO 27001 is the certifiable standard containing the requirements for an information security management system, and it is the one in the ISO 27000 family an organisation certifies its ISMS against. ISO 27002 is a non-certifiable guideline that provides detailed implementation guidance for the same 93 controls listed in Annex A of ISO 27001. An auditor assesses your ISMS against ISO 27001, not against ISO 27002. Using ISO 27002 is a choice, not an obligation.
Your product runs on more than Tidal Control
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services