ISO/IEC 27001 is a whole series of documents.
They deal with the topic of information security management in either a normative (i.e., requiring) or informative (i.e., recommending) manner. The various documents have different objectives and are partly aimed at different target groups. The central document is ISO/IEC 27001, which deals with the minimum requirements for an information security management system (ISMS) (chapters 4 to 10). On the other hand, Annex A describes over 114 security measures – the so-called controls – in a tabular presentation. The second main document, ISO/IEC 27002, is called the „Code of Practice“ and contains approximately 90 pages of implementation guidance for the controls described in ISO/IEC 27001. In our ISO 27001 training courses, we deal intensively with the individual parts of the standard.