ISO 27001 vs ISO 27002: What Each One Is, and Why Only One Certifies

Same 93 controls, same numbering, entirely different documents. Which one you are audited against, what the other one is for, why no accredited ISO 27002 certificate exists, and where the rest of the 27000 family fits.

Short answer

ISO/IEC 27001:2022 is a requirements standard and you can be certified against it. ISO/IEC 27002:2022 is a guidance standard and you cannot. They cover the same 93 controls under the same numbering, but 27001 tells you what your management system must do and lists the control titles in Annex A, while 27002 explains what each control means, why it exists and how to implement it. One is audited; the other is read.

The practical consequence is that you build the ISMS from 27001 and you implement the controls with 27002 open beside you. Any organisation offering an “ISO 27002 certificate” is either misdescribing a training certificate, misdescribing an unaccredited assessment, or selling something that does not exist. There is no accredited certification scheme for ISO/IEC 27002, because the document contains no requirements to audit against.

ISO/IEC 27001:2022

Requirements

Certifiable. Clauses 4–10 plus Annex A control titles.

ISO/IEC 27002:2022

Guidance

Not certifiable. Purpose, guidance and attributes per control.

Shared

93 controls

Same numbering in four themes: A.5, A.6, A.7, A.8.

Attributes

5, in 27002 only

Type, properties, concepts, capabilities, domains.

This page is the standards-landscape companion to our full guide on ISO 27001 certification in the Philippines. For the control list itself, see all 93 Annex A controls and the evidence each one needs.

The difference in one table

ISO/IEC 27001:2022 ISO/IEC 27002:2022
Full title Information security, cybersecurity and privacy protection — Information security management systems — Requirements Information security, cybersecurity and privacy protection — Information security controls
Type of document A requirements standard. Written in “shall”. A guidance standard. Written in “should”.
Can you be certified to it? Yes — by a certification body accredited for the ISMS scheme. No. There are no requirements to audit against.
What it covers The management system: context, leadership, planning, support, operation, performance evaluation and improvement — clauses 4 to 10. The controls only. No management system requirements at all.
How controls appear Annex A: 93 control reference titles, in four themes. Titles, nothing more. Clauses 5 to 8: the same 93 controls, each with attributes, a control statement, a purpose, implementation guidance and other information.
Length Short. The requirements occupy a small number of pages. Long. The guidance is the bulk of the document.
Who reads it The ISMS manager, top management, the internal auditor and the certification body. Whoever has to actually implement a control and wants to know what “good” looks like.
Role in the SoA Clause 6.1.3 d) requires the Statement of Applicability; Annex A is what you cross-check against. Explains what each SoA line means, which is why SoA justifications written without it read as boilerplate.

What ISO/IEC 27001:2022 actually contains

ISO/IEC 27001:2022 is a management system standard built on the harmonised structure that ISO uses across ISO 9001, ISO 14001 and the rest. Clauses 1 to 3 are scope, normative references and terms. The auditable requirements are clauses 4 to 10.

Clause What it requires Where people underestimate it
4 Context Determine external and internal issues, the needs and expectations of interested parties, the scope of the ISMS, and establish the ISMS itself. Amendment 1:2024 added a requirement to determine whether climate change is a relevant issue under 4.1, and a note to 4.2 that interested parties can have climate-related requirements. It changes no Annex A control.
5 Leadership Top management commitment, the information security policy, and assignment of roles, responsibilities and authorities. The policy is a top-management obligation, not a document the ISMS manager writes and circulates for signature.
6 Planning Actions to address risks and opportunities, the risk assessment process (6.1.2), the risk treatment process and the SoA (6.1.3), objectives (6.2), and planning of changes (6.3). Clause 6.3, planning of changes, was added in 2022 and is routinely missed by systems migrated from the 2013 edition.
7 Support Resources, competence, awareness, communication and documented information. Clause 7.4 requires you to determine what to communicate, when, to whom and how. Most ISMSs have no communication plan at all.
8 Operation Operational planning and control, risk assessment at planned intervals and on significant change, and risk treatment. Clause 8.1 requires control of externally provided processes, products and services relevant to the ISMS — which is where outsourcing lives.
9 Performance evaluation Monitoring and measurement (9.1), internal audit (9.2), management review (9.3). The clauses most likely to delay certification. See internal audit and management review.
10 Improvement Continual improvement (10.1) and nonconformity and corrective action (10.2). The 2022 edition reversed the 2013 numbering. Anyone citing “10.1 Nonconformity” is working from a withdrawn document.
Annex A A normative annex listing 93 information security control reference titles in four themes. Titles only. No guidance, no purpose statement, no attributes. That material is in 27002.

What ISO/IEC 27002:2022 actually contains

ISO/IEC 27002:2022 presents the same 93 controls, under the same numbering, in four clauses: clause 5 organizational controls, clause 6 people controls, clause 7 physical controls and clause 8 technological controls. It contains no management system requirements and no “shall” obligations for your organisation.

What makes it worth having is the structure of each control entry. For every one of the 93, the document gives:

Element What it gives you Why it matters at Stage 2
Attribute table Five attributes assigned to the control: control type; information security properties; cybersecurity concepts; operational capabilities; security domains. Lets you produce views of your control set that a board or a client can read — all preventive controls, all controls supporting availability, all detection controls.
Control The control statement itself — a fuller sentence than the Annex A title. This is what your SoA line should reflect. Copying the Annex A title alone loses the substance.
Purpose One sentence on why the control exists. The single most useful sentence in the document for writing an inclusion justification that is not boilerplate.
Guidance Implementation guidance, often running to a page or more, covering what the control should address in practice. What an auditor has in mind when they ask whether your implementation is adequate. They are not auditing you against it, but it shapes what “adequate” means.
Other information Context, related standards and points that did not belong in the guidance. Frequently points to the specialised standard you actually needed — incident management, supplier relationships, business continuity.
Because 27002 is guidance, a certification body cannot raise a nonconformity for departing from it. What they can do is raise a nonconformity against clause 6.1.3 or against your own SoA if the control you claimed as implemented does not achieve its purpose. The guidance is how you find out what the purpose is.

Annex A is the bridge — and it is titles only

Annex A of ISO/IEC 27001:2022 is a normative annex containing the 93 control reference titles, derived from the controls in clauses 5 to 8 of ISO/IEC 27002:2022. Normative means it is part of the standard, not optional reading — but what it contains is a list, not a specification.

This is the source of the most consequential misunderstanding in the entire standard. Clause 6.1.3 c) requires you to compare the controls you determined necessary against Annex A to verify that no necessary control has been omitted. The comparison runs from your risk treatment to Annex A. It does not run the other way, and the standard is explicit that organisations can design controls as required or identify them from any source.

Question ISO/IEC 27001 Annex A ISO/IEC 27002
Does it tell me what the control means? No. A title such as “Threat intelligence” and nothing else. Yes. Control statement, purpose and implementation guidance.
Is it normative? Yes — and clause 6.1.3 requires the comparison against it. No. It is referenced but not imposed.
Do I get audited against it? Against your SoA, which is built from the comparison. Yes. No.
Can I exclude items? Yes, with a justification recorded in the SoA under clause 6.1.3 d). The question does not arise; nothing in it is mandatory.
Can I add controls it does not contain? Yes, and you must if your risk treatment requires them. Annex A is a completeness check, not a ceiling. Yes.

Our complete list of all 93 Annex A controls gives every control title exactly as Annex A words it, grouped by theme, with the evidence a Stage 2 auditor typically asks for against each — the evidence column being Sterling experience rather than text from either standard.

The five attributes, and how to use them properly

The five attributes are the genuine innovation of the 2022 edition of 27002, and almost nobody uses them. They exist so that a single control set can be viewed along more than one axis, which is what makes control reporting comprehensible to people who do not think in Annex A numbers.

Attribute Values The view it gives you
Control type Preventive, detective, corrective. Whether your control set is balanced. A set that is 85 per cent preventive with almost nothing detective explains why incidents are found by customers.
Information security properties Confidentiality, integrity, availability. Which property is under-served. Most Philippine control sets are heavy on confidentiality and thin on integrity, which shows up the first time data is silently corrupted rather than stolen.
Cybersecurity concepts Identify, protect, detect, respond, recover. The mapping most clients and boards already recognise, because it is the vocabulary of widely used cybersecurity frameworks. This is the attribute to use in client-facing reporting.
Operational capabilities Practitioner categories such as governance, asset management, identity and access management, threat and vulnerability management, continuity, supplier relationships security, and others. Maps controls to the team that owns them, which is how you turn an SoA into a work breakdown that people accept.
Security domains Governance and ecosystem, protection, defence, resilience. A coarse strategic view, useful for a board paper and for showing where budget is concentrated.
The attributes are in ISO/IEC 27002:2022 only. They are not in Annex A of ISO/IEC 27001:2022, they are not mandatory, and no auditor will ask for them. Adding attribute columns to your SoA is nonetheless one of the cheapest upgrades available: it costs a day and it converts a compliance artefact into a management report.

You cannot be certified to ISO 27002. Here is what is being sold.

Accredited certification requires auditable requirements. ISO/IEC 27002 contains none — it is written in “should”, not “shall”. There is therefore no accreditation scheme, no certification body accredited for it, and no certificate that any accreditation body will stand behind. When someone presents an “ISO 27002 certificate”, one of the following is true.

What it probably is How to tell What to do
A personal training certificate It names an individual, not an organisation, and the issuer is a training provider or examination institute. Legitimate, and useful evidence of competence under clause 7.2. It certifies a person, not a management system, and does not belong in a tender response as a company credential.
An unaccredited assessment It names the organisation but carries no accreditation body mark and cannot be found on any accreditation directory. Verify it the way you would verify any certificate — see accredited certification bodies and how to check a certificate. If the accreditation cannot be traced, treat the document as marketing.
A misdescribed ISO 27001 certificate The certificate itself says ISO/IEC 27001; the sales deck says 27002. Harmless confusion at the vendor’s end, but it tells you how well the vendor understands the standard they are selling you.
A gap assessment sold as certification Deliverable is a report against the 27002 controls, presented with a certificate-like cover. A gap assessment is a legitimate service. Presenting it as certification is not, and it will not survive a client’s due diligence questionnaire.
The same reasoning applies to every guidance document in the family. You cannot be certified to ISO/IEC 27005, ISO/IEC 27003 or ISO/IEC 27004 either. Certification in this family is against ISO/IEC 27001 and, since the 2025 edition, ISO/IEC 27701 as a standalone privacy certification. Everything else is guidance.

Using the two together, phase by phase

Project phase ISO/IEC 27001 gives you ISO/IEC 27002 gives you
Scope and context Clauses 4.1, 4.2 and 4.3 — the requirements for determining issues, interested parties and boundaries. Nothing. This phase is 27001 only, which is why a project that starts from the control list starts in the wrong document.
Risk assessment Clause 6.1.2 — criteria, identification, analysis, evaluation, risk owners. Nothing directly. ISO/IEC 27005:2022 is the guidance standard for this phase.
Determining controls Clause 6.1.3 a) and b) — select treatment options and determine all necessary controls. The purpose statement for each control, which is what tells you whether a control would actually treat your risk.
Annex A cross-check Clause 6.1.3 c) and Annex A — verify nothing necessary was omitted. Enough detail to decide whether a control is relevant, rather than guessing from a four-word title.
Statement of Applicability Clause 6.1.3 d) — the four things the SoA must contain. The material from which a non-boilerplate justification is written. See risk assessment and the SoA.
Implementation Clause 8 — operational planning and control. The implementation guidance itself. This is the phase 27002 exists for, and the phase in which most teams have never opened it.
Internal audit Clause 9.2 — the audit programme and its requirements. The benchmark for judging whether an implementation is adequate rather than merely present.
Certification audit Everything. This is what you are audited against. Not audited. But the auditor has read it, and it informs what they consider adequate.

Editions, titles and the 2013-to-2022 arithmetic

Both standards were revised in 2022 and both changed title. The 2013 editions sat under “Information technology — Security techniques”; the 2022 editions sit under “Information security, cybersecurity and privacy protection”. ISO/IEC 27002 also dropped “Code of practice for” from its title, which is a small change with a real meaning: the document was repositioned from a code of practice to a reference set of controls.

The transition from ISO/IEC 27001:2013 ended on 31 October 2025. Certificates against the 2013 edition are no longer valid, and a 2013-edition certificate presented today is a red flag rather than a legacy document.

On the control counts, the arithmetic reconciles cleanly and it is worth being able to state it, because a great deal of published commentary cannot:

What happened Count Running effect
2013 edition 114 controls In 14 clauses, under the “A.5” to “A.18” numbering.
Consolidated 57 → 24 Fifty-seven 2013 controls restated as twenty-four. Overlapping requirements now stated once.
Split 1 → 2 One control separated into two because it carried two distinct obligations.
Carried forward individually 56 Retained one-for-one, many renamed and with rewritten guidance.
New 11 Threat intelligence; cloud services; ICT readiness for business continuity; physical security monitoring; configuration management; information deletion; data masking; data leakage prevention; monitoring activities; web filtering; secure coding.
Removed 0 Nothing was abandoned. Every 2013 obligation survives somewhere.
2022 edition 93 controls 24 + 2 + 56 + 11 = 93, drawn from 57 + 1 + 56 = 114, in four themes: A.5 Organizational (37), A.6 People (8), A.7 Physical (14), A.8 Technological (34).
The figure to be careful with. A widely repeated summary states that 58 of the 2013 controls were merged into 24. That does not reconcile — 58 consolidated, plus one split into two, plus eleven new, leaves 55 carried forward and a total of 92, not 93. Fifty-seven is the figure that balances. And in any real migration the headline count is irrelevant: what you use is the correspondence annex in ISO/IEC 27002:2022, which shows control by control where each 2013 requirement went.

Do you have to buy both? And what you may not copy

ISO/IEC 27001 is not optional: you cannot build a management system against a standard you have not read, and the auditor will assume you have the current edition. ISO/IEC 27002 is technically optional and practically indispensable — without it your implementers are working from four-word control titles and your SoA justifications will read like they were written from four-word control titles, because they were.

Both are copyrighted documents sold by ISO and by national member bodies. That has three practical consequences that consultants routinely ignore:

  • You cannot paste the guidance text into your own procedures. Restating a control’s intent in your own words is fine and produces better procedures anyway. Copying pages of 27002 into a policy is a copyright problem and an audit problem, because the auditor can see that the procedure does not describe your organisation.
  • Toolkits that reproduce the standards are selling you a liability. If a document set contains what looks like the guidance text verbatim, ask the vendor about their licence.
  • Per-user licensing is real. A single-user PDF circulated to thirty implementers breaches the licence. For a team, buy a multi-user licence or a subscription from a national member body.

This is also why every page on this site states control titles and clause requirements in substance, attributes them to their clause, and does not reproduce the standards’ text. If a provider hands you what appears to be the full text of Annex A guidance in a free download, that tells you something about how they handle other people’s intellectual property — and you are about to give them yours.

The rest of the ISO/IEC 27000 family, and what each is for

Only two documents in this family carry accredited certification: ISO/IEC 27001, and ISO/IEC 27701 since its 2025 edition made it a standalone privacy certification. Everything else is guidance, or is addressed to your certification body rather than to you.

Standard What it is Certifiable?
ISO/IEC 27000 Overview of the family and the vocabulary the other standards use. ISO makes it available free of charge, which makes it the cheapest way to settle a terminology argument. No — vocabulary
ISO/IEC 27001:2022 The ISMS requirements. Clauses 4 to 10 plus Annex A. Yes
ISO/IEC 27002:2022 Implementation guidance for the 93 controls, with the five attributes. No — guidance
ISO/IEC 27003 Guidance on the ISMS requirements themselves — how to interpret clauses 4 to 10. Underused, and more useful to a first-time implementer than 27002. No — guidance
ISO/IEC 27004 Guidance on monitoring, measurement, analysis and evaluation. The document to reach for when clause 9.1 metrics are the problem, which they usually are. No — guidance
ISO/IEC 27005:2022 Guidance on managing information security risks. Widely mistaken for a requirement; it is not, and you may use any method that satisfies clause 6.1.2. No — guidance
ISO/IEC 27006-1:2024 Requirements for bodies providing audit and certification of information security management systems, including how audit duration is derived from the effective number of personnel. No — it binds your certification body, not you
ISO/IEC 27007 Guidelines for auditing information security management systems. Useful when building an internal audit programme. No — guidance
ISO/IEC 27017:2015 Cloud services controls based on ISO/IEC 27002. The second edition has cleared ballot: the ISO catalogue records edition 2 at stage 60.00 with a July 2026 publication date, rebased on ISO/IEC 27002:2022 (verified 1 August 2026). Certificates in issue reference the 2015 edition and remain valid. Assessed as an extension to a 27001 scope
ISO/IEC 27018:2025 Controls for protecting personally identifiable information when acting as a PII processor in a public cloud. Third edition, published August 2025, aligned to ISO/IEC 27002:2022. Appears constantly in EU and US due-diligence questionnaires sent to Philippine processors. Assessed as an extension to a 27001 scope
ISO/IEC 27031 Guidelines for ICT readiness for business continuity — the subject matter of the new control A.5.30. No — guidance
ISO/IEC 27035 series Information security incident management: principles, planning and preparation, response. Behind controls A.5.24 to A.5.28. No — guidance
ISO/IEC 27036 series Supplier relationships security, including cloud services. Behind controls A.5.19 to A.5.23. No — guidance
ISO/IEC 27701:2025 Privacy information management. The 2025 edition made it a standalone certification rather than only an extension to a 27001 certificate — a material change for Philippine organisations whose exposure is personal data rather than information generally. Yes — standalone since the 2025 edition
Editions are stated only where we have verified the current edition against the ISO catalogue. Where no year is shown, check the catalogue before citing an edition in a tender or a policy — this family is revised continuously and a confidently wrong edition number in a bid document is an unforced error.

Seven mistakes that come from confusing the two

  • Starting the project from the control list. Opening 27002 and working down the 93 controls inverts clause 6.1.3. Controls come out of risk treatment; the standard says so explicitly.
  • Writing SoA justifications from Annex A titles. A four-word title cannot support a justification. The purpose statement in 27002 can, and the difference is visible on the page.
  • Claiming ISO 27002 compliance in a tender. A procurement officer who knows the family will read it as a signal that you do not, and it is a poor look next to a competitor holding an accredited 27001 certificate.
  • Assuming Annex A is a ceiling. If your risk treatment needs a control Annex A does not contain, it still belongs in your ISMS. Annex A is a completeness check.
  • Treating 27002 guidance as auditable requirements. Building procedures that promise every line of the guidance creates obligations under clause 7.5.1 b) that you then have to evidence. You have made guidance mandatory to yourself.
  • Buying 27002 and not 27001. Surprisingly common, because the controls feel like the real content. You cannot build a management system from a control list.
  • Ignoring the attributes. Not a nonconformity, but a wasted asset: a day of work converts an SoA into control reporting a board can act on.

Sterling Academy · e-learning for your people

Training that stands up in your ISO 27001 audit

Sterling consulting clients benefit from preferential course access and special pricing on Sterling Academy through their Sterling consultant, including complimentary ISO 27001 awareness training for your people as part of your engagement. Your consultant sets up your client administrator, you add your people, and every learner who completes a course and its final exam receives a numbered Certificate of Completion, verifiable online.

Completion records and certificates are your evidence for ISO/IEC 27001:2022 clauses 7.2 (competence) and 7.3 (awareness) and for Annex A control 6.3, information security awareness, education and training — the items a certification auditor tests by interviewing your staff.

Courses for an information security management system

End to end with Sterling: your ISO 27001 engagement includes

  • Implementation consulting through Design™ (guided) or Drive™ (fully managed), up to the certification audit
  • Sterling Academy e-learning for your people: preferential course access and special pricing, with complimentary ISO 27001 awareness training
  • Live internal auditor training for your audit team
  • Effivity ISMS software subscription
  • Vulnerability assessment by Cyber Vantage 360
  • Sustain™ post-certification support: internal audits, management reviews and surveillance preparation

List price from US$19 per learner per course (51–200 learners) · 12 months’ access · final exam included

Contact usSee the course on Sterling AcademyWatch the sample video →

Certificate of Completion issued after the final exam, numbered and verifiable online · Sterling consultant, client administrator and learner roles as on Sterling Academy

ISO 27001 vs ISO 27002: frequently asked questions

1. What is the difference between ISO 27001 and ISO 27002?
ISO/IEC 27001:2022 is a requirements standard: it specifies what an information security management system must do across clauses 4 to 10 and lists 93 control reference titles in Annex A. ISO/IEC 27002:2022 is a guidance standard covering the same 93 controls, giving each one a control statement, a purpose, implementation guidance and five attributes. You are certified against 27001. You implement with 27002 open beside you.

2. Can you get certified to ISO 27002?
No. There is no accredited certification scheme for ISO/IEC 27002 because the document contains no requirements to audit against — it is written in “should”, not “shall”. Anything presented as an ISO 27002 certificate is normally a personal training certificate, an unaccredited assessment, or a misdescribed ISO 27001 certificate. Accredited certification in this family is against ISO/IEC 27001 and, since the 2025 edition, ISO/IEC 27701 as a standalone privacy certification.

3. Do I need to buy both standards?
You need ISO/IEC 27001 — you cannot build a management system against requirements you have not read. ISO/IEC 27002 is technically optional and practically indispensable, because Annex A gives control titles only. Implementers working from four-word titles produce control implementations and SoA justifications that read exactly like that. Both are copyrighted and licensed per user, so buy a multi-user licence if a team needs access.

4. Is Annex A of ISO 27001 the same as ISO 27002?
Same controls, same numbering, radically different content. Annex A is a normative annex listing the 93 control reference titles derived from clauses 5 to 8 of ISO/IEC 27002:2022 — titles and nothing else. ISO/IEC 27002 gives each control a fuller control statement, a purpose, implementation guidance running to a page or more, and the five attributes. Annex A tells you what the control is called; 27002 tells you what it means.

5. What are the five attributes in ISO 27002:2022?
Control type (preventive, detective, corrective); information security properties (confidentiality, integrity, availability); cybersecurity concepts (identify, protect, detect, respond, recover); operational capabilities; and security domains (governance and ecosystem, protection, defence, resilience). They exist in ISO/IEC 27002:2022 only, are not in Annex A of ISO/IEC 27001, are not mandatory, and no auditor will ask for them — but adding them as columns to your SoA turns a compliance artefact into a management report for about a day of work.

6. Why did the control count drop from 114 to 93?
Because overlapping requirements are now stated once. Fifty-seven of the 2013 controls were consolidated into twenty-four, one was split into two, fifty-six were carried forward individually, and eleven new controls were added: 24 + 2 + 56 + 11 = 93, drawn from 57 + 1 + 56 = 114. Nothing was removed. Be wary of the widely repeated claim that 58 were merged into 24 — that arithmetic produces 92, not 93.

7. Is ISO 27005 mandatory for the risk assessment?
No. ISO/IEC 27005:2022 is guidance on managing information security risks and is not a certification requirement. Clause 6.1.2 of ISO/IEC 27001:2022 requires you to define a risk assessment process with risk criteria that produces consistent, valid and comparable results; it does not prescribe a method. Asset-threat-vulnerability analysis was mandatory only in the withdrawn 2005 edition, and you may use any method that meets the clause.

8. Does ISO 27002 have an Amendment 1:2024 like ISO 27001?
The climate change amendment applies to ISO/IEC 27001:2022 as a management system standard: Amendment 1:2024 adds to clause 4.1 a requirement to determine whether climate change is a relevant issue, and adds a note to clause 4.2 that interested parties can have climate-related requirements. It changes no Annex A control and adds no sixteenth mandatory document. Check the ISO catalogue for the current status of any amendment to ISO/IEC 27002 before citing one.

9. Which standard do our implementers actually need?
Give the ISMS manager and the internal auditor ISO/IEC 27001. Give everyone implementing a control ISO/IEC 27002, because the purpose statement and guidance are what let them build something adequate rather than something present. Consider ISO/IEC 27003 for a first-time implementation team — it explains the management system clauses, which is where first-time projects actually struggle, and it is the most underused document in the family.

10. If ISO 27002 is not auditable, why does the auditor care about it?
Because it defines what adequate looks like. A certification body cannot raise a nonconformity for departing from guidance, but it can raise one against clause 6.1.3 or against your own Statement of Applicability if a control you claimed as implemented does not achieve its purpose. The purpose statement is in ISO/IEC 27002. Auditors have read it, and it shapes the standard they hold your implementation to.

Get the standards landscape mapped to your actual exposure

Most organisations are sold more standards than they need and the wrong ones first. Sterling maps what your clients, regulators and contracts actually require — 27001 alone, 27001 with 27017 or 27018, or 27701 as a standalone privacy certification — and tells you plainly which ones you can safely leave until later.

Talk to a Sterling ISO 27001 consultant

11. Is training included with Sterling’s ISO 27001 consulting?
Every Sterling engagement includes live internal auditor training for your audit team and preferential access to Sterling Academy, with complimentary ISO 27001 awareness training for your people as part of the engagement. Special pricing applies to the wider catalogue — Information Security Essentials, 93 Annex A Controls (ISO/IEC 27002:2022) and Risk Management — through your Sterling consultant. Learners who complete a course and its final exam receive a numbered Certificate of Completion, verifiable online, and the completion records serve as evidence for clauses 7.2 and 7.3 and Annex A control 6.3.

Where to go next

Written and maintained by the ISO 27001 practice at Sterling International Consulting, Philippines. All clause and control references are to ISO/IEC 27001:2022 including Amendment 1:2024. Last updated: 1 August 2026.