Which of the following statements about the relationship between ISO/IEC 27001 and ISO/IEC 27002 is true? ISO/IEC 27002 provides implementation…

ISO/IEC 27001 is the standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). A core part of this is the information security risk management process (Clauses 6.1.2 and 8.2).

ISO/IEC 27002 serves as a supplementary code of practice. It provides a reference set of generic information security controls and offers detailed implementation guidance for the controls listed in Annex A of ISO/IEC 27001. Therefore, after an organization uses the ISO/IEC 27001 process to identify necessary controls, it can refer to ISO/IEC 27002 for advice on how to implement them. Statement 1 is true, while statement 2 is false.

B. Only 2 is true: This is incorrect. ISO/IEC 27001 defines the requirements for the risk management process, not ISO/IEC 27002, which is a guidance document for controls.

C. Both 1 and 2 are true: This is incorrect because statement 2 is false. ISO/IEC 27002 does not provide the process for information security risk management.

D. Neither 1 or 2 is true: This is incorrect because statement 1 accurately describes the relationship where ISO/IEC 27002 provides implementation guidance for controls selected via the ISO/IEC 27001 process.

---

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Annex A, Note 1: "The information security controls listed in Annex A are directly derived from and aligned with those listed in ISO/IEC 27002:2022." This confirms the direct link and that 27002 provides the detail for the controls referenced in 27001.

Clause 6.1.2: This clause details the requirements for the "Information security risk assessment" process, establishing that the process requirements are within ISO/IEC 27001 itself.

2. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls.

Introduction, 0.1 General: "This document provides a reference set of generic information security controls including implementation guidance... It is designed to be used by organizations... for selecting, implementing and managing controls..." This explicitly states its purpose is to provide implementation guidance for controls.

3. University of Oslo, Course IN5250 – "Security in operating systems and software" Lecture Notes.

Lecture 1: Introduction to Information Security Management, Slide 18, "ISO 27000 series": The slide deck clarifies the relationship: "ISO 27001 - ISMS Requirements (What to do)" and "ISO 27002 - Code of practice for IS controls (How to do it)". This academic source supports that 27001 defines requirements and 27002 provides implementation guidance.