ISO/IEC 27000 Family Map Template (Editions, Certifiable, Reading Order)

ISO/IEC 27000 Family Map: [Organization name]

A map of the ISO/IEC 27000 family of information security, cybersecurity and privacy standards as listed in the ISO catalogue on 2026-11-01, with the related management system and certification standards that an information security management system (ISMS) team meets in practice. It supports the planning of an ISMS under ISO/IEC 27001:2022 + Amd 1:2024 and the control of external documents (clause 7.5.3). For each standard it shows the current edition, what kind of document it is, whether an organisation can be certified against it, whether a revision is in progress, and which template in this library puts it to work. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. How the family is organised
3. Requirements standards
4. General guidance standards
5. Sector and topic standards
6. Related standards outside the 27000 series
7. Certifiable or not: summary
8. Revision watch
9. Size tiers: what to buy and read first
10. Decision table: if you are X, read Y
11. From standard to template
12. Maintaining this map
13. Records and evidence
14. References

1. Purpose and scope

This map tells the people who run the ISMS at [Organization name] which standards exist, which ones matter to us, which edition we work to and where each one is used in our documentation. It covers:

• the ISO/IEC 27000 family maintained by ISO/IEC JTC 1/SC 27, as listed in the ISO catalogue on the catalogue check date in the Document control table;
• the related standards that an ISMS meets in practice: auditing (ISO 19011), certification (ISO/IEC 17021-1), business continuity and crisis management (ISO 22301, ISO 22361), risk management (ISO 31000), artificial intelligence management (ISO/IEC 42001) and the privacy framework (ISO/IEC 29100).

It does not cover national standards, sector schemes run by regulators or non-ISO frameworks. Those belong in the control framework crosswalk (isms/control-framework-crosswalk) and the legal, regulatory and contractual register (DOC-ISMS-014, compliance/legal-register).

Users of this map: the ISMS manager, risk and control owners who need to know where guidance lives, internal auditors, and anyone joining the ISMS team who follows the learning path (isms/isms-learning-path).

2. How the family is organised

The family has a simple shape once the layers are clear:

1. Overview and vocabulary. ISO/IEC 27000:2026 explains the concepts and principles behind the family and gives a small set of terms. The 2026 edition is much shorter on terms than the 2018 edition it replaces, so do not expect the long term list you may remember.
2. Requirements for organisations. ISO/IEC 27001 (ISMS) and, since 2025, ISO/IEC 27701 (privacy information management system, PIMS) as a stand-alone standard. These are the documents a certification body audits you against.
3. Requirements for certification bodies. ISO/IEC 27006-1 (ISMS) and ISO/IEC 27706 (PIMS) add to ISO/IEC 17021-1. You do not implement them, but they explain how your audit is planned and how audit time is calculated.
4. Requirements for writers of standards. ISO/IEC 27009 covered the rules for sector-specific standards built on ISO/IEC 27001. Its 2020 edition is shown as withdrawn in the catalogue and only a preliminary work item for a new edition is listed, so treat it as background.
5. General guidance. ISO/IEC 27002 (controls), 27003 (implementing the requirements), 27004 (measurement), 27005 (risk), 27007 (auditing an ISMS), TS 27008 (assessing controls), 27013 (integration with service management), 27014 (governance), TS 27022 (ISMS processes) and 27021 (competence of ISMS professionals).
6. Sector and topic guidance. Extra controls or guidance for a sector (telecom, energy, health, cloud) or for a topic (network security, application security, incident management, supplier relationships, digital evidence, storage, AI, PKI, IoT).

Read the arrows as "supports" or "is used with". Guidance feeds the ISMS you build under ISO/IEC 27001. The certification body standards describe how your conformity to the requirements standards is audited. ISO/IEC 27701:2025 can be implemented on its own or together with ISO/IEC 27001; the arrow from 27001 to 27701 shows the common case of a PIMS built on an existing ISMS, not a dependency in the 2025 edition. The dashed arrow marks ISO/IEC 27009, whose 2020 edition is withdrawn.

3. Requirements standards

Points that matter for an ISMS team:

• Transition. Certificates to ISO/IEC 27001:2013 ended with the transition period on 2025-10-31. Every valid ISO/IEC 27001 certificate now refers to the 2022 edition. Certification bodies check the climate change determination added to 4.1 and 4.2 by Amd 1:2024 during normal audits; ask yours how it handles the amendment.
• ISO/IEC 27701:2025. Organisations that held a 27701:2019 extension must plan the move to the stand-alone edition with their certification body. The transition arrangements are set by the accreditation and certification bodies, so ask yours.
• Certification body documents. Reading the relevant parts of ISO/IEC 27006-1 helps you understand audit time, multi-site sampling and what the auditor must see. Audit time is always set by the certification body; do not plan with a figure from a forum post.

4. General guidance standards

How to use guidance well:

• Use ISO/IEC 27002 as the reference when you write control descriptions, but write your own controls. The Statement of Applicability (DOC-ISMS-011) lists the 93 Annex A controls; ISO/IEC 27002 explains them.
• Read ISO/IEC 27003 clause by clause while you build the clause 4 to 10 documents. Because a revision is in progress, check whether a newer edition has been published before you buy it.
• Use ISO/IEC 27005 to design the risk method, not to copy a method. The library method (DOC-ISMS-010) is one worked option on a 5 x 5 scale.

5. Sector and topic standards

5.1 Sector standards

5.2 Topic standards

For multi-part standards, the map lists the parts verified for this library. Other parts exist with their own editions and review states: check the catalogue for the part you need before buying it.

6. Related standards outside the 27000 series

7. Certifiable or not: summary

Rules for claims:

1. Say "certified to ISO/IEC 27001:2022" only when you hold a valid certificate, and state its scope. See isms/certification-mark-usage.
2. Prefer accredited certification. Check that the certification body is accredited by an accreditation body that is a signatory of the Global ACI MRA (formerly the IAF MLA; Global Accreditation Cooperation Incorporated replaced IAF and ILAC on 2026-01-01), and check the certificate in the IAF CertSearch database (still operating at the catalogue check date; confirm before relying on it). Do not display the Global ACI MRA or legacy IAF MLA mark yourself: certified organizations generally may use only the certification body's own mark, under its rules.
3. For guidance standards, write "our controls take account of ISO/IEC 27017:2026" rather than "compliant with ISO/IEC 27017".

8. Revision watch

Recently published editions to update in older documents (examples of what an annual check finds):

• ISO/IEC 27000:2026 replaces the 2018 edition.
• ISO/IEC 27017:2026 replaces the 2015 edition.
• ISO/IEC 27018:2025 replaces the 2019 edition.
• ISO/IEC 27701:2025 replaces the 2019 extension and is now stand-alone.
• ISO/IEC 27706:2025 replaces ISO/IEC TS 27006-2:2021.
• ISO 27799:2025 replaces the 2016 edition.
• ISO 19011:2026 replaces the 2018 edition.
• ISO/IEC 27090:2026 is new (published 2026-10-14).

When a new edition appears, decide: no change, update references only, or plan a change to the ISMS. Planned changes to the ISMS go through the ISMS change plan (DOC-ISMS-025, isms/isms-change-plan).

9. Size tiers: what to buy and read first

The library uses three working tiers (not official definitions) and three fictional organisations. The purchase order below is Example.

What changes by tier:

• Small. Two standards are enough to start. Buy cloud guidance only when customers or the risk assessment need it. The part-time ISMS manager reads ISO/IEC 27001 in full and uses ISO/IEC 27002 as a reference, not cover to cover.
• Medium. Risk and privacy standards come early because the organisation is a processor and controller of health data. A multi-user licence is usually needed for the security team.
• Large or multi-site. Governance, integration and certification body documents matter because the ISMS joins an existing integrated management system and the audit samples several sites. Keep one group standards library and give sites read access instead of buying local copies.

Licensing note: purchased standards carry licence terms on copying and sharing. Keep copies in a controlled location, respect the number of users in the licence and never paste ISO text into internal wikis.

10. Decision table: if you are X, read Y

The decision flow adds standards to the base set; every path ends with ISO/IEC 27001 and ISO/IEC 27002 because they are the core of any ISMS.

11. From standard to template

12. Maintaining this map

1. Owner. The ISMS manager owns the map and the standards library.
2. Cadence. Check every row against the ISO catalogue at least once a year, before the internal audit, and record the check date in the Document control table.
3. Triggers. Update the map when a standard you use gets a new edition, amendment or withdrawal; when you add a service, sector or certification; when a customer contract names a standard; and when your certification body announces a transition.
4. Check method. Search the standard number on iso.org, read the edition, publication date and life-cycle stage, and compare with the table. For anything in a revision, note the stage reached.
5. Downstream updates. When an edition changes, list the documents that cite it (search the document register for the standard number), update their references and record the change in their revision history.
6. Communication. Tell control owners about edition changes that affect them through the communication plan (DOC-ISMS-027).

13. Records and evidence

Standards library register:

Link each register entry to the documented information register (DOC-ISMS-028, isms/isms-documented-information-register) and, where a standard supports a control, to the control evidence matrix (DOC-ISMS-033, isms/control-evidence-matrix).

14. References

The parts of ISO/IEC 27035 and 27036, ISO/IEC 27400, ISO/IEC 27402 and ISO/IEC 27009 are cited without a link; find them by number in the ISO catalogue.

Related templates: isms/isms-learning-path, isms/isms-glossary, isms/iso-27001-clauses-explained, isms/certification-audit-explained, compliance/iso-map, isms/control-framework-crosswalk, isms/isms-documented-information-register, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with ISO/IEC 27000:2026, which gives an overview of the ISMS family, and with ISO/IEC 27001:2022 + Amd 1:2024 clause 7.5.3 on external documents. Editions and life-cycle stages come from the ISO catalogue as checked on 2026-11-01. The summaries, tables, tier advice and decision rules are original text. No ISO or IEC text, full titles, clauses, controls or definitions are reproduced; you need the official standards, sold by ISO, IEC and national standards bodies, to implement any of them. Editions change: check the current edition and life-cycle stage of each standard on iso.org before you rely on this map. This is a documentation format, not certification or legal advice. Template licence: MIT.