ISO/IEC 27001:2022 is the requirement standard. An organization can be certified against it. ISO/IEC 27003 is guidance on how to apply it. The draft explains the 2022 requirement clause by clause and control by control. One is the rule, the other is the manual.
The short answer, expanded
ISO/IEC 27001:2022 is the requirement standard. An organization can be certified against it. ISO/IEC 27003 is guidance on how to apply it. The draft explains the 2022 requirement clause by clause and control by control. One is the rule, the other is the manual.
What to do next
The free check turns this answer into a dated reading for your organization. The register gives you the clause or control behind the answer. If the question is about a customer or a tender, answer with the requirement standard and the certificate, not with a draft.
Run the free check Open the register
Related questions
Which one does an auditor use?
The auditor uses the requirement standard and the certification scheme. The guidance can inform the method, not the finding.
Which one do I buy?
Buy 27001:2022 first. The guidance is useful, not required.
Which one is in my SoA?
The SoA is against 27001:2022 Annex A. 27003 does not add controls.