ISO/IEC 27002:2022 gives implementation guidance for the 93 Annex A controls. ISO/IEC 27003 gives guidance on the management system clauses and how to apply the requirement as a whole. Use 27002 for a control and 27003 for the system.
The short answer, expanded
ISO/IEC 27002:2022 gives implementation guidance for the 93 Annex A controls. ISO/IEC 27003 gives guidance on the management system clauses and how to apply the requirement as a whole. Use 27002 for a control and 27003 for the system.
What to do next
The free check turns this answer into a dated reading for your organization. The register gives you the clause or control behind the answer. If the question is about a customer or a tender, answer with the requirement standard and the certificate, not with a draft.
Run the free check Open the register
Related questions
Do I need both?
27002 is the practical control reference. 27003 is the system-level guide. Most teams need 27002 first.
Does 27003 repeat 27002?
It should not. The record separates the system clauses from the control guidance.
Where do the control pages come from?
The control pages state the Annex A control and the 27002 guidance, then add the ISMS evidence discipline.