# ISO/IEC 27000 Family Map: [Organization name]

> A map of the ISO/IEC 27000 family of information security, cybersecurity
> and privacy standards as listed in the ISO catalogue on 2026-11-01, with
> the related management system and certification standards that an
> information security management system (ISMS) team meets in practice.
> It supports the planning of an ISMS under ISO/IEC 27001:2022 + Amd
> 1:2024 and the control of external documents (clause 7.5.3). For each
> standard it shows the current edition, what kind of document it is,
> whether an organisation can be certified against it, whether a revision
> is in progress, and which template in this library puts it to work.
> Replace every `[bracketed]` value and every row marked *Example*.

<!--
Guidance: How to use this template
- Use it at the start of an ISMS project, when someone asks "which ISO
  standards do we need to buy and read?", and once a year to refresh the
  standards library the ISMS depends on.
- Fill the Document control table first, then section 9 (what you will buy
  and in which order) and section 13 (your standards library register).
  The tables in sections 3 to 8 are a reference: check every edition
  against the ISO catalogue on the day you use the map, because editions
  change several times a year.
- Main pitfall: treating every standard with "27" in its number as a
  requirement. Only a few documents contain requirements an organisation
  can be certified against. Most are guidance that helps you meet those
  requirements, and some are written for certification bodies or for
  people who draft other standards.
- This map gives standard numbers, editions and original one-line
  summaries. It does not reproduce titles in full, clauses, controls or
  definitions. Buy the official standards for that.
- Related templates: `isms/isms-learning-path`, `isms/isms-glossary`,
  `isms/iso-27001-clauses-explained`, `compliance/iso-map`,
  `isms/control-framework-crosswalk`, `isms/isms-documented-information-register`.
-->

## Document control

<!-- Guidance: The family map is a learning and reference document. Keep it under document control because the standards library it describes is external documented information under clause 7.5.3, and auditors may ask how you know which edition you work to. -->

| Field | Value |
|---|---|
| Document ID | LRN-ISMS-10 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@compliance-lead] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO/IEC 27000:2026 (family overview); ISO/IEC 27001:2022 + Amd 1:2024 |
| Catalogue check date | [2026-11-01, ISO catalogue] |
| Standards library location | [Path or system where licensed copies are kept] |
| Next scheduled review | YYYY-MM-DD |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| CISO or security lead | [@ciso] | [Approved / Approved with changes] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | 2026-11-01 | [@isms-manager] | First map, editions checked against the ISO catalogue |
| 1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | ISO/IEC 27014 new edition published, row and revision watch updated |

## Contents

<!-- Guidance: Sections 2 to 8 describe the family. Sections 9 to 11 turn the map into decisions. Sections 12 to 14 keep the map alive. -->

1. Purpose and scope
2. How the family is organised
3. Requirements standards
4. General guidance standards
5. Sector and topic standards
6. Related standards outside the 27000 series
7. Certifiable or not: summary
8. Revision watch
9. Size tiers: what to buy and read first
10. Decision table: if you are X, read Y
11. From standard to template
12. Maintaining this map
13. Records and evidence
14. References

## 1. Purpose and scope

<!-- Guidance: State why your organisation keeps this map and who uses it. An auditor will not ask for a family map, but will ask how you control external documents and how you know your sources are current. -->

This map tells the people who run the ISMS at [Organization name] which
standards exist, which ones matter to us, which edition we work to and
where each one is used in our documentation. It covers:

- the ISO/IEC 27000 family maintained by ISO/IEC JTC 1/SC 27, as listed
  in the ISO catalogue on the catalogue check date in the Document
  control table;
- the related standards that an ISMS meets in practice: auditing
  (ISO 19011), certification (ISO/IEC 17021-1), business continuity and
  crisis management (ISO 22301, ISO 22361), risk management (ISO 31000),
  artificial intelligence management (ISO/IEC 42001) and the privacy
  framework (ISO/IEC 29100).

It does not cover national standards, sector schemes run by regulators
or non-ISO frameworks. Those belong in the control framework crosswalk
(`isms/control-framework-crosswalk`) and the legal, regulatory and
contractual register (DOC-ISMS-014, `compliance/legal-register`).

Users of this map: the ISMS manager, risk and control owners who need to
know where guidance lives, internal auditors, and anyone joining the
ISMS team who follows the learning path (`isms/isms-learning-path`).

## 2. How the family is organised

<!-- Guidance: Explain the layers before the tables. Most confusion comes from mixing requirements with guidance. The diagram shows the dependency direction: guidance and sector documents support ISO/IEC 27001, they do not replace it. -->

The family has a simple shape once the layers are clear:

1. **Overview and vocabulary.** ISO/IEC 27000:2026 explains the concepts
   and principles behind the family and gives a small set of terms. The
   2026 edition is much shorter on terms than the 2018 edition it
   replaces, so do not expect the long term list you may remember.
2. **Requirements for organisations.** ISO/IEC 27001 (ISMS) and, since
   2025, ISO/IEC 27701 (privacy information management system, PIMS) as
   a stand-alone standard. These are the documents a certification body
   audits you against.
3. **Requirements for certification bodies.** ISO/IEC 27006-1 (ISMS) and
   ISO/IEC 27706 (PIMS) add to ISO/IEC 17021-1. You do not implement
   them, but they explain how your audit is planned and how audit time
   is calculated.
4. **Requirements for writers of standards.** ISO/IEC 27009 covered the
   rules for sector-specific standards built on ISO/IEC 27001. Its 2020
   edition is shown as withdrawn in the catalogue and only a preliminary
   work item for a new edition is listed, so treat it as background.
5. **General guidance.** ISO/IEC 27002 (controls), 27003 (implementing
   the requirements), 27004 (measurement), 27005 (risk), 27007 (auditing
   an ISMS), TS 27008 (assessing controls), 27013 (integration with
   service management), 27014 (governance), TS 27022 (ISMS processes)
   and 27021 (competence of ISMS professionals).
6. **Sector and topic guidance.** Extra controls or guidance for a sector
   (telecom, energy, health, cloud) or for a topic (network security,
   application security, incident management, supplier relationships,
   digital evidence, storage, AI, PKI, IoT).

```mermaid
flowchart TD
  OV["ISO/IEC 27000:2026 overview and terms"] --> REQ
  subgraph REQ["Requirements for organisations"]
    R1["ISO/IEC 27001:2022 + Amd 1:2024 ISMS"]
    R2["ISO/IEC 27701:2025 PIMS"]
  end
  subgraph CB["Requirements for certification bodies"]
    C0["ISO/IEC 17021-1:2015"]
    C1["ISO/IEC 27006-1:2024 ISMS"]
    C2["ISO/IEC 27706:2025 PIMS"]
  end
  subgraph GUI["General guidance"]
    G1["27002 controls"]
    G2["27003 implementation"]
    G3["27004 measurement"]
    G4["27005 risk"]
    G5["27007 and TS 27008 auditing"]
    G6["27013, 27014, TS 27022, 27021"]
  end
  subgraph SEC["Sector and topic guidance"]
    S1["Sector: 27011, 27017, 27018, 27019, 27799"]
    S2["Topic: 27031 to 27040, 27090, 27099, 27400, 27402"]
  end
  W["ISO/IEC 27009:2020 rules for sector standards, withdrawn"] -.-> S1
  GUI --> R1
  SEC --> R1
  R1 --> R2
  C0 --> C1
  C0 --> C2
  C1 -->|audits| R1
  C2 -->|audits| R2
```

Read the arrows as "supports" or "is used with". Guidance feeds the ISMS
you build under ISO/IEC 27001. The certification body standards describe
how your conformity to the requirements standards is audited. ISO/IEC
27701:2025 can be implemented on its own or together with ISO/IEC 27001;
the arrow from 27001 to 27701 shows the common case of a PIMS built on an
existing ISMS, not a dependency in the 2025 edition. The dashed arrow
marks ISO/IEC 27009, whose 2020 edition is withdrawn.

## 3. Requirements standards

<!-- Guidance: These are the documents that contain "shall" statements for someone. Note who the "someone" is: an organisation, a certification body or a standards writer. Check the status column against the catalogue on the day you use the map. -->

| Standard | Edition (cite as) | Requirements for | Certifiable for an organisation | Status on 2026-11-01 | Library template |
|---|---|---|---|---|---|
| ISO/IEC 27001 | ISO/IEC 27001:2022 + Amd 1:2024 | Organisations operating an ISMS | Yes | Current. Amd 1 (2024-02-23) added climate change to clauses 4.1 and 4.2; Annex A unchanged. No new edition project listed | `compliance/statement-of-applicability`, `isms/isms-manual` |
| ISO/IEC 27701 | ISO/IEC 27701:2025 | PII controllers and PII processors operating a PIMS | Yes, on its own or with 27001 | Current. Stand-alone since 2025, replaces the 2019 extension to 27001 | `isms/pims-27701-scope-roles`, `isms/pims-27701-statement-of-applicability` |
| ISO/IEC 27006-1 | ISO/IEC 27006-1:2024 | Bodies certifying ISMS (adds to ISO/IEC 17021-1) | No (applies to certification bodies) | Current. A preliminary work item for the next edition is listed | `isms/certification-audit-explained`, `isms/certification-body-selection` |
| ISO/IEC 27706 | ISO/IEC 27706:2025 | Bodies certifying PIMS | No (applies to certification bodies) | Current. Replaces ISO/IEC TS 27006-2:2021 | `isms/certification-body-selection` |
| ISO/IEC 27009 | ISO/IEC 27009:2020 (last edition) | Writers of sector-specific standards based on 27001 | No | The 2020 edition is shown as withdrawn in the catalogue, with a preliminary work item for a new edition. Check the status before citing it | Not applicable |

Points that matter for an ISMS team:

- **Transition.** Certificates to ISO/IEC 27001:2013 ended with the
  transition period on 2025-10-31. Every valid ISO/IEC 27001 certificate
  now refers to the 2022 edition. Certification bodies check the climate
  change determination added to 4.1 and 4.2 by Amd 1:2024 during normal
  audits; ask yours how it handles the amendment.
- **ISO/IEC 27701:2025.** Organisations that held a 27701:2019 extension
  must plan the move to the stand-alone edition with their certification
  body. The transition arrangements are set by the accreditation and
  certification bodies, so ask yours.
- **Certification body documents.** Reading the relevant parts of ISO/IEC
  27006-1 helps you understand audit time, multi-site sampling and what
  the auditor must see. Audit time is always set by the certification
  body; do not plan with a figure from a forum post.

## 4. General guidance standards

<!-- Guidance: Guidance standards use "should". Nobody audits you against them, but auditors use them as a yardstick of good practice, and some customers ask for alignment. Buy 27002 with 27001, then the others when the work needs them. -->

| Standard | Edition (cite as) | What it helps with (original summary) | Status on 2026-11-01 | Library template |
|---|---|---|---|---|
| ISO/IEC 27000 | ISO/IEC 27000:2026 | Concepts, principles and a short list of terms for the family | Current (6th edition, 2026-07-03) | `isms/isms-glossary` |
| ISO/IEC 27002 | ISO/IEC 27002:2022 | Purpose and implementation guidance for each Annex A control, with attributes for sorting controls | Current. The catalogue links a follow-up project; no newer edition published | `isms/annex-a-organizational-controls-guide`, `isms/annex-a-people-physical-controls-guide`, `isms/annex-a-technological-controls-guide` |
| ISO/IEC 27003 | ISO/IEC 27003:2017 | Explanation of each ISMS requirement in clauses 4 to 10 | A revision is in progress (DIS stage); check for a newer edition | `isms/iso-27001-clauses-explained` |
| ISO/IEC 27004 | ISO/IEC 27004:2016 | Monitoring, measurement, analysis and evaluation of the ISMS | A revision is in progress (DIS stage) | `isms/isms-measurement-programme` |
| ISO/IEC 27005 | ISO/IEC 27005:2022 | Information security risk management, with event-based and asset-based identification | Current | `compliance/risk-methodology`, `isms/isms-threat-vulnerability-catalogue` |
| ISO/IEC 27007 | ISO/IEC 27007:2020 | Auditing an ISMS, building on ISO 19011 | A revision is in progress (DIS stage) | `isms/isms-internal-audit-checklist` |
| ISO/IEC TS 27008 | ISO/IEC TS 27008:2019 | Assessing whether controls are implemented and effective | A revision is in progress (CD stage) | `isms/control-evidence-matrix` |
| ISO/IEC 27013 | ISO/IEC 27013:2021 + Amd 1:2024 | Integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1 | Current | `isms/integrated-management-27013` |
| ISO/IEC 27014 | ISO/IEC 27014:2020 | Governance of information security by the governing body | New edition at FDIS stage; expect a new edition soon | `isms/information-security-governance-27014` |
| ISO/IEC TS 27022 | ISO/IEC TS 27022:2021 | A process reference model for running ISMS processes | Under systematic review; a preliminary work item for a revision is listed | `isms/isms-process-map` |
| ISO/IEC 27021 | ISO/IEC 27021:2017 + Amd 1:2021 | Competence requirements for ISMS professionals | Current. Systematic review closed (stage 90.60), decision pending | `isms/isms-competence-training-matrix` |

How to use guidance well:

- Use ISO/IEC 27002 as the reference when you write control descriptions,
  but write your own controls. The Statement of Applicability (DOC-ISMS-011)
  lists the 93 Annex A controls; ISO/IEC 27002 explains them.
- Read ISO/IEC 27003 clause by clause while you build the clause 4 to 10
  documents. Because a revision is in progress, check whether a newer
  edition has been published before you buy it.
- Use ISO/IEC 27005 to design the risk method, not to copy a method. The
  library method (DOC-ISMS-010) is one worked option on a 5 x 5 scale.

## 5. Sector and topic standards

<!-- Guidance: Pick only the documents that match a real sector, service or risk you have. Each extra standard adds controls to your SoA and evidence to your audits. Record the choice and the reason in section 9. -->

### 5.1 Sector standards

| Standard | Edition (cite as) | Sector or role | Typical use | Library template |
|---|---|---|---|---|
| ISO/IEC 27011 | ISO/IEC 27011:2024 | Telecommunications organisations | Extra guidance and controls for telecom operators | `isms/telecom-27011-controls` |
| ISO/IEC 27017 | ISO/IEC 27017:2026 | Cloud service providers and cloud service customers | Cloud-specific guidance and additional controls. New edition 2026-07-27: check the 2026 edition for its control set | `isms/cloud-27017-controls` |
| ISO/IEC 27018 | ISO/IEC 27018:2025 | Public cloud providers processing PII as processors | Controls for PII protection in public cloud, aligned with ISO/IEC 29100 principles | `isms/cloud-pii-27018-processor` |
| ISO/IEC 27019 | ISO/IEC 27019:2024 | Energy utility industry | Process control and OT guidance for energy | `isms/energy-27019-controls` |
| ISO 27799 | ISO 27799:2025 | Health organisations | Applying ISO/IEC 27002 controls to personal health information | `isms/health-27799-controls` |

### 5.2 Topic standards

| Standard | Edition (cite as) | Topic | Typical use | Library template |
|---|---|---|---|---|
| ISO/IEC 27031 | ISO/IEC 27031:2025 | ICT readiness for business continuity | ICT recovery objectives and readiness planning (A.5.30) | `isms/ict-readiness-business-continuity-plan` |
| ISO/IEC 27032 | ISO/IEC 27032:2023 | Internet security | Roles of interested parties and common Internet security issues | `isms/threat-intelligence-procedure` |
| ISO/IEC 27033 (multi-part) | Part 1: ISO/IEC 27033-1:2015 (check other parts) | Network security | Network architecture, segmentation and secure communication | `isms/network-security-standard` |
| ISO/IEC 27034 (multi-part) | Part 1: ISO/IEC 27034-1:2011 (check other parts) | Application security | Application security framework for development | `isms/secure-development-policy`, `security/secure-coding-standard` |
| ISO/IEC 27035 (multi-part) | 27035-1:2023, 27035-2:2023, 27035-3:2020, 27035-4:2024 | Incident management | Incident process, planning, operations and coordination | `compliance/incident-response-plan`, `isms/incident-register` |
| ISO/IEC 27036 (multi-part) | 27036-1:2021, 27036-2:2022, 27036-3:2023, 27036-4:2016 | Supplier relationships, including ICT supply chain and cloud services | Supplier requirements, agreements and monitoring | `isms/supplier-security-agreement-27036`, `isms/supplier-register` |
| ISO/IEC 27037 | ISO/IEC 27037:2012 | Digital evidence | Identification, collection and preservation of digital evidence (A.5.28) | `security/forensic-evidence-record` |
| ISO/IEC 27040 | ISO/IEC 27040:2024 | Storage security | Securing storage systems and media, including sanitisation | `isms/backup-policy`, `isms/equipment-disposal-reuse-record` |
| ISO/IEC 27090 | ISO/IEC 27090:2026 | Security of AI systems | AI-specific threats, detection and mitigation across the AI life cycle | `ai-data/iso-27090-ai-security-review` |
| ISO/IEC 27099 | ISO/IEC 27099:2022 | Public key infrastructure | PKI practices and policy | `security/cryptography-standard`, `isms/cryptographic-key-register` |
| ISO/IEC 27400 | ISO/IEC 27400:2022 | IoT security and privacy | Guidelines for IoT solutions | `isms/iot-27400-security` |
| ISO/IEC 27402 | ISO/IEC 27402:2023 | IoT device baseline | Baseline requirements for IoT devices | `isms/iot-27400-security` |

For multi-part standards, the map lists the parts verified for this
library. Other parts exist with their own editions and review states:
check the catalogue for the part you need before buying it.

## 6. Related standards outside the 27000 series

<!-- Guidance: These standards are not part of the 27000 family but sit next to it in almost every ISMS. Note which ones you are already certified to: an integrated management system reuses their processes. -->

| Standard | Edition (cite as) | Role next to the ISMS | Certifiable for an organisation | Status on 2026-11-01 | Library template |
|---|---|---|---|---|---|
| ISO 19011 | ISO 19011:2026 | Guidance on auditing management systems, used for the internal audit programme | No (guidance) | Current (2026-05-27) | `compliance/internal-audit-program` |
| ISO/IEC 17021-1 | ISO/IEC 17021-1:2015 | Requirements for all management system certification bodies: Stage 1, Stage 2, surveillance, recertification | No (applies to certification bodies) | Current. Systematic review closed (stage 90.60), decision pending | `isms/certification-audit-explained` |
| ISO 22301 | ISO 22301:2019 + Amd 1:2024 | Business continuity management system | Yes | Revision at CD stage | `compliance/business-continuity`, `compliance/business-impact-analysis` |
| ISO 22361 | ISO 22361:2022 | Crisis management guidance | No (guidance) | Current | `isms/crisis-management-communications-plan` |
| ISO 31000 | ISO 31000:2018 | Enterprise risk management principles and process | No (guidance) | Revision at CD stage | `compliance/risk-methodology` |
| ISO/IEC 42001 | ISO/IEC 42001:2023 | AI management system | Yes | Current | `compliance/iso-42001-statement-of-applicability`, `isms/iso-27001-42001-integrated-soa` |
| ISO/IEC 29100 | ISO/IEC 29100:2024 | Privacy framework: actors, roles and privacy principles | No (framework) | Current | `isms/pims-27701-scope-roles` |

## 7. Certifiable or not: summary

<!-- Guidance: Use this section to answer the sales or board question "can we get certified to X?". If the answer is "no, but", explain the "but" (assessment alongside 27001, statements of conformity). Never promise a certificate: the certification decision belongs to the accredited certification body. -->

| Category | Standards | What an organisation can obtain |
|---|---|---|
| Certifiable management system requirements | ISO/IEC 27001, ISO/IEC 27701, ISO 22301, ISO/IEC 42001 | Accredited certification by a certification body that is accredited for that standard |
| Certification body requirements | ISO/IEC 17021-1, ISO/IEC 27006-1, ISO/IEC 27706 | Nothing directly. Use them to check how your certification body works and to select one |
| Requirements for standards writers | ISO/IEC 27009 | Nothing |
| Guidance with extra controls | ISO/IEC 27017, 27018, 27011, 27019, ISO 27799 | No certificate on their own. Many certification bodies assess these controls together with ISO/IEC 27001 and reference them on the certificate or in a separate statement. Ask your certification body what it offers and under which accreditation |
| Guidance only | All other standards in sections 4 to 6 | No certificate. You may state alignment in your own words, never "certified to" |

Rules for claims:

1. Say "certified to ISO/IEC 27001:2022" only when you hold a valid
   certificate, and state its scope. See `isms/certification-mark-usage`.
2. Prefer accredited certification. Check that the certification body is
   accredited by an accreditation body that is a signatory of the Global
   ACI MRA (formerly the IAF MLA; Global Accreditation Cooperation
   Incorporated replaced IAF and ILAC on 2026-01-01), and check the
   certificate in the IAF CertSearch database (still operating at the
   catalogue check date; confirm before relying on it). Do not display
   the Global ACI MRA or legacy IAF MLA mark yourself: certified
   organizations generally may use only the certification body's own
   mark, under its rules.
3. For guidance standards, write "our controls take account of ISO/IEC
   27017:2026" rather than "compliant with ISO/IEC 27017".

## 8. Revision watch

<!-- Guidance: Standards change. Keep a short watch list of documents with a revision under way, the stage reached and the date you checked. Stage names follow the ISO project stages (preliminary, CD committee draft, DIS draft international standard, FDIS final draft, published). -->

| Standard | Current edition | Revision status on 2026-11-01 | Effect on [Organization name] | Watch owner |
|---|---|---|---|---|
| ISO/IEC 27014 | 2020 | New edition at FDIS stage | Update the governance report template references when published | [@isms-manager] |
| ISO/IEC 27003 | 2017 | DIS stage | Check for a newer edition before buying | [@isms-manager] |
| ISO/IEC 27004 | 2016 | DIS stage | Measurement programme may need new references | [@isms-manager] |
| ISO/IEC 27007 | 2020 | DIS stage | Internal audit checklist references | [@internal-audit] |
| ISO/IEC TS 27008 | 2019 | CD stage | Control assessment method references | [@internal-audit] |
| ISO/IEC 27006-1 | 2024 | Preliminary work item | Possible changes to audit time rules in a future cycle | [@isms-manager] |
| ISO/IEC TS 27022 | 2021 | Preliminary work item | Process map references | [@isms-manager] |
| ISO/IEC 27009 | 2020 (withdrawn in the catalogue) | Preliminary work item | None for most organisations | [@isms-manager] |
| ISO 22301 | 2019 + Amd 1:2024 | CD stage | BCMS documents if certified to ISO 22301 | [@bc-manager] |
| ISO 31000 | 2018 | CD stage | Enterprise risk alignment | [@risk-manager] |
| [Standard] | [Edition] | [Stage] | [Effect] | [@owner] |

Recently published editions to update in older documents (examples of
what an annual check finds):

- ISO/IEC 27000:2026 replaces the 2018 edition.
- ISO/IEC 27017:2026 replaces the 2015 edition.
- ISO/IEC 27018:2025 replaces the 2019 edition.
- ISO/IEC 27701:2025 replaces the 2019 extension and is now stand-alone.
- ISO/IEC 27706:2025 replaces ISO/IEC TS 27006-2:2021.
- ISO 27799:2025 replaces the 2016 edition.
- ISO 19011:2026 replaces the 2018 edition.
- ISO/IEC 27090:2026 is new (published 2026-10-14).

When a new edition appears, decide: no change, update references only,
or plan a change to the ISMS. Planned changes to the ISMS go through the
ISMS change plan (DOC-ISMS-025, `isms/isms-change-plan`).

## 9. Size tiers: what to buy and read first

<!-- Guidance: Buy only what the work needs now. A small organisation can start with two standards. Record why each extra standard is bought so the purchase list survives a budget review. Prices vary by seller and format: check the ISO store or your national standards body. -->

The library uses three working tiers (not official definitions) and
three fictional organisations. The purchase order below is *Example*.

| Order | Small: Quillmere Analytics Ltd *(Example)* | Medium: Quillmere Health Systems *(Example)* | Large: Quillmere Group *(Example)* |
|---|---|---|---|
| Profile | 46 staff (38 employees, 8 contractors), B2B SaaS on one public cloud in two regions, processor of customer personal data, part-time ISMS manager (0.5 FTE), certification target 6 months | 320 staff, clinical scheduling software and managed service, two offices and a colocation suite, processor and controller, full-time ISMS manager plus 3-person security team, 27001 in 10 months and 27701 the year after | 2,400 staff, 6 sites in 4 countries, OT and IT, ISO 9001 and ISO 22301 certified, CISO with a 14-person security office, group 27001 in 15 months phased by site |
| 1 | ISO/IEC 27001:2022 + Amd 1:2024 | ISO/IEC 27001:2022 + Amd 1:2024 | ISO/IEC 27001:2022 + Amd 1:2024 |
| 2 | ISO/IEC 27002:2022 | ISO/IEC 27002:2022 | ISO/IEC 27002:2022 |
| 3 | ISO/IEC 27017:2026 and ISO/IEC 27018:2025 (customers ask for cloud and PII processor controls) | ISO/IEC 27005:2022 | ISO/IEC 27005:2022 and ISO/IEC 27014:2020 (or the new edition once published) |
| 4 | ISO/IEC 27005:2022 when the risk method is designed | ISO/IEC 27701:2025 and ISO 27799:2025 (health data, PIMS the year after) | ISO/IEC 27019:2024 only if a plant runs energy-utility process control (for example on-site power generation), and ISO/IEC 27013 if IT service management is certified to ISO/IEC 20000-1 |
| 5 | ISO/IEC 27003 after checking whether the new edition is out | ISO/IEC 27035-1 and -2 (incident process for hospital customers), ISO 19011:2026 | ISO/IEC 27006-1:2024 to understand multi-site sampling, ISO/IEC 27031:2025, ISO 19011:2026 |
| Read but not buy | ISO/IEC 27000:2026 (freely viewable parts on the ISO online browsing platform, where available) | Same | Same, plus the integrated management system mapping |
| Total standards bought | 5 or 6 (27003 optional) | 8 | 7 to 9 (27019 and 27013 conditional) |

What changes by tier:

- **Small.** Two standards are enough to start. Buy cloud guidance only
  when customers or the risk assessment need it. The part-time ISMS
  manager reads ISO/IEC 27001 in full and uses ISO/IEC 27002 as a
  reference, not cover to cover.
- **Medium.** Risk and privacy standards come early because the
  organisation is a processor and controller of health data. A
  multi-user licence is usually needed for the security team.
- **Large or multi-site.** Governance, integration and certification body
  documents matter because the ISMS joins an existing integrated
  management system and the audit samples several sites. Keep one group
  standards library and give sites read access instead of buying local
  copies.

Licensing note: purchased standards carry licence terms on copying and
sharing. Keep copies in a controlled location, respect the number of
users in the licence and never paste ISO text into internal wikis.

## 10. Decision table: if you are X, read Y

<!-- Guidance: Use this table in onboarding and in steering committee discussions. Extend it with rows for your own roles and customers. Keep the "why" short and practical. -->

| If you are | Read first | Then | Why |
|---|---|---|---|
| Starting an ISMS with no prior ISO experience | ISO/IEC 27001 clauses 4 to 10 | ISO/IEC 27003, `isms/isms-learning-path` | Requirements first, explanation second |
| Writing or reviewing control descriptions | ISO/IEC 27002 | Sector guidance that applies to you | Purpose and guidance per control |
| Designing the risk method | ISO/IEC 27005 | ISO 31000, `compliance/risk-methodology` | Risk process options and alignment with enterprise risk |
| A cloud service provider (SaaS, PaaS, IaaS) | ISO/IEC 27017 | ISO/IEC 27018 if you process PII for customers, ISO/IEC 27036-4 | Cloud roles, shared responsibility, PII processor controls |
| A cloud service customer | ISO/IEC 27017 (customer guidance) | ISO/IEC 27036 parts, `isms/cloud-services-security-policy` | Due diligence and A.5.23 cloud services |
| A PII controller or processor wanting a privacy certificate | ISO/IEC 27701:2025 | ISO/IEC 29100, ISO/IEC 27018 | Stand-alone PIMS requirements |
| An energy utility or OT operator | ISO/IEC 27019 | ISO/IEC 27001 Annex A, `isms/energy-27019-controls` | Process control environment |
| A telecom operator | ISO/IEC 27011 | `isms/telecom-27011-controls` | Telecom-specific controls |
| A health organisation | ISO 27799 | ISO/IEC 27701 | Personal health information |
| Building or deploying AI systems | ISO/IEC 42001 | ISO/IEC 27090, `isms/iso-27001-42001-integrated-soa` | AI management system plus AI security threats |
| An internal auditor | ISO 19011 | ISO/IEC 27007, TS 27008 | Audit principles, ISMS audit practice, control assessment |
| Preparing for certification | ISO/IEC 17021-1 (overview) | ISO/IEC 27006-1, `isms/certification-audit-explained` | How Stage 1, Stage 2 and surveillance work and how audit time is set |
| Running service management to ISO/IEC 20000-1 | ISO/IEC 27013 | `isms/integrated-management-27013` | One integrated system instead of two |
| A board member or governing body | ISO/IEC 27014 | `isms/information-security-governance-27014` | Governance responsibilities and reporting |
| Measuring ISMS performance | ISO/IEC 27004 | `isms/isms-measurement-programme` | Measures, methods and evaluation |
| Planning ICT recovery | ISO/IEC 27031 | ISO 22301, `compliance/business-continuity` | ICT readiness for continuity |
| Handling incidents | ISO/IEC 27035-1 and -2 | ISO/IEC 27037, `compliance/incident-response-plan` | Incident process and evidence |
| Managing suppliers | ISO/IEC 27036-1 and -2 | ISO/IEC 27036-3 for ICT supply chain | Supplier agreements and monitoring |
| [Your role] | [Standard] | [Next] | [Why] |

```mermaid
flowchart LR
  Q1{"Processing personal data?"} -->|yes| P["Add ISO/IEC 27701 and 29100"]
  Q1 -->|no| Q2
  P --> Q2{"Providing cloud services?"}
  Q2 -->|yes| C["Add ISO/IEC 27017, and 27018 if PII processor"]
  Q2 -->|no| Q3
  C --> Q3{"Sector with its own extension?"}
  Q3 -->|yes| S["Add 27011, 27019 or 27799"]
  Q3 -->|no| Q4
  S --> Q4{"Developing or using AI?"}
  Q4 -->|yes| A["Add ISO/IEC 42001 and 27090"]
  Q4 -->|no| B["Base set: 27001 and 27002"]
  A --> B
```

The decision flow adds standards to the base set; every path ends with
ISO/IEC 27001 and ISO/IEC 27002 because they are the core of any ISMS.

## 11. From standard to template

<!-- Guidance: Show where each standard you use shows up in your documents. This is the quickest way to answer an auditor who asks "how did you use ISO/IEC 27005?". -->

| Standard | Where it is applied at [Organization name] | Document ID |
|---|---|---|
| ISO/IEC 27001 4.1 to 4.3 | Context, interested parties and scope | DOC-ISMS-003, DOC-ISMS-002 |
| ISO/IEC 27001 4.4 and TS 27022 | ISMS process map | DOC-ISMS-004 |
| ISO/IEC 27001 5.2 | Information security policy | DOC-ISMS-001 |
| ISO/IEC 27001 6.1.2, ISO/IEC 27005 | Risk assessment methodology and risk criteria | DOC-ISMS-010, DOC-ISMS-015 |
| ISO/IEC 27001 6.1.3, ISO/IEC 27002 | Statement of Applicability and risk treatment plan | DOC-ISMS-011, DOC-ISMS-013 |
| ISO/IEC 27001 7.2, ISO/IEC 27021 | Competence and training matrix | DOC-ISMS-026 |
| ISO/IEC 27001 7.5 | Documented information register | DOC-ISMS-028 |
| ISO/IEC 27001 9.1, ISO/IEC 27004 | Measurement programme | DOC-ISMS-080 |
| ISO/IEC 27001 9.2, ISO 19011, ISO/IEC 27007 | Internal audit programme | DOC-ISMS-082 |
| ISO/IEC 27001 9.3 | Management review minutes | DOC-ISMS-085 |
| ISO/IEC 27035 | Incident response plan | DOC-ISMS-020 |
| ISO/IEC 27031, ISO 22301 | ICT readiness plan, business continuity plan | DOC-ISMS-047, DOC-ISMS-121 |
| ISO/IEC 27036 | Supplier security agreement | DOC-ISMS-068 |
| ISO/IEC 27017 | Cloud service controls | DOC-ISMS-102 |
| ISO/IEC 27018 | Public cloud PII processor controls | DOC-ISMS-103 |
| ISO/IEC 27701 | PIMS scope and roles, PIMS SoA | DOC-ISMS-100, DOC-ISMS-101 |
| ISO/IEC 27014 | Information security governance report | DOC-ISMS-104 |
| ISO/IEC 27013 | Integrated management system mapping | DOC-ISMS-105 |
| ISO/IEC 42001 | Integrated 27001 and 42001 SoA | DOC-ISMS-107 |

## 12. Maintaining this map

<!-- Guidance: A map that is two years old will cite withdrawn editions. Give it an owner, a cadence and triggers. The annual check takes about an hour with the ISO catalogue open. -->

1. **Owner.** The ISMS manager owns the map and the standards library.
2. **Cadence.** Check every row against the ISO catalogue at least once a
   year, before the internal audit, and record the check date in the
   Document control table.
3. **Triggers.** Update the map when a standard you use gets a new
   edition, amendment or withdrawal; when you add a service, sector or
   certification; when a customer contract names a standard; and when
   your certification body announces a transition.
4. **Check method.** Search the standard number on iso.org, read the
   edition, publication date and life-cycle stage, and compare with the
   table. For anything in a revision, note the stage reached.
5. **Downstream updates.** When an edition changes, list the documents
   that cite it (search the document register for the standard number),
   update their references and record the change in their revision
   history.
6. **Communication.** Tell control owners about edition changes that
   affect them through the communication plan (DOC-ISMS-027).

## 13. Records and evidence

<!-- Guidance: The records below show that external documents are identified and controlled (7.5.3) and that the ISMS works from current sources. Keep them light. -->

| Record | What it proves | Owner | Where kept | Retention |
|---|---|---|---|---|
| Standards library register (table below) | External documents are identified, versioned and licensed | [@isms-manager] | [Document system] | Current plus previous version |
| Annual catalogue check entry in the revision history | Editions are verified at least yearly | [@isms-manager] | This document | Life of the ISMS |
| Purchase and licence records | Copies are legally held for the stated number of users | [@procurement] | [Finance system] | As per finance retention |
| Edition change decisions | New editions are assessed and changes planned | [@isms-manager] | ISMS change plan (DOC-ISMS-025) | 3 years or one certification cycle |

Standards library register:

| Lib ID | Standard and edition | Format and licence | Users allowed | Location | Purchased | Next check |
|---|---|---|---|---|---|---|
| STD-001 *(Example)* | ISO/IEC 27001:2022 + Amd 1:2024 | PDF, single user | 1 | [Controlled folder] | 2026-11-01 | 2027-11-01 |
| STD-002 *(Example)* | ISO/IEC 27002:2022 | PDF, single user | 1 | [Controlled folder] | 2026-11-01 | 2027-11-01 |
| STD-003 *(Example)* | ISO/IEC 27017:2026 | PDF, single user | 1 | [Controlled folder] | 2026-11-15 | 2027-11-01 |
| [STD-nnn] | [Standard] | [Format] | [n] | [Location] | YYYY-MM-DD | YYYY-MM-DD |

Link each register entry to the documented information register
(DOC-ISMS-028, `isms/isms-documented-information-register`) and, where a
standard supports a control, to the control evidence matrix (DOC-ISMS-033,
`isms/control-evidence-matrix`).

## 14. References

<!-- Guidance: Cite editions exactly and link only to official catalogue pages. -->

| Reference | Edition | Link |
|---|---|---|
| ISO/IEC 27000 | 2026 | https://www.iso.org/standard/84257.html |
| ISO/IEC 27001 and Amd 1 | 2022 and Amd 1:2024 | https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html |
| ISO/IEC 27002 | 2022 | https://www.iso.org/standard/75652.html |
| ISO/IEC 27003 | 2017 | https://www.iso.org/standard/63417.html |
| ISO/IEC 27004 | 2016 | https://www.iso.org/standard/64120.html |
| ISO/IEC 27005 | 2022 | https://www.iso.org/standard/80585.html |
| ISO/IEC 27006-1 | 2024 | https://www.iso.org/standard/82908.html |
| ISO/IEC 27706 | 2025 | https://www.iso.org/standard/82894.html |
| ISO/IEC 27007 | 2020 | https://www.iso.org/standard/77802.html |
| ISO/IEC TS 27008 | 2019 | https://www.iso.org/standard/67397.html |
| ISO/IEC 27011 | 2024 | https://www.iso.org/standard/80584.html |
| ISO/IEC 27013 | 2021 + Amd 1:2024 | https://www.iso.org/standard/78752.html |
| ISO/IEC 27014 | 2020 | https://www.iso.org/standard/74046.html |
| ISO/IEC 27017 | 2026 | https://www.iso.org/standard/82878.html |
| ISO/IEC 27018 | 2025 | https://www.iso.org/standard/88150.html |
| ISO/IEC 27019 | 2024 | https://www.iso.org/standard/85056.html |
| ISO/IEC 27021 | 2017 + Amd 1:2021 | https://www.iso.org/standard/61003.html |
| ISO/IEC TS 27022 | 2021 | https://www.iso.org/standard/61004.html |
| ISO/IEC 27031 | 2025 | https://www.iso.org/standard/80975.html |
| ISO/IEC 27032 | 2023 | https://www.iso.org/standard/76070.html |
| ISO/IEC 27033-1 | 2015 | https://www.iso.org/standard/63461.html |
| ISO/IEC 27034-1 | 2011 | https://www.iso.org/standard/44378.html |
| ISO/IEC 27037 | 2012 | https://www.iso.org/standard/44381.html |
| ISO/IEC 27040 | 2024 | https://www.iso.org/standard/80194.html |
| ISO/IEC 27090 | 2026 | https://www.iso.org/standard/56581.html |
| ISO/IEC 27099 | 2022 | https://www.iso.org/standard/56590.html |
| ISO/IEC 27701 | 2025 | https://www.iso.org/standard/85819.html |
| ISO 27799 | 2025 | https://www.iso.org/standard/84647.html |
| ISO/IEC 29100 | 2024 | https://www.iso.org/standard/85938.html |
| ISO/IEC 42001 | 2023 | https://www.iso.org/standard/81230.html |
| ISO 19011 | 2026 | https://www.iso.org/standard/88984.html |
| ISO/IEC 17021-1 | 2015 | https://www.iso.org/standard/61651.html |
| ISO 22301 | 2019 + Amd 1:2024 | https://www.iso.org/standard/75106.html |
| ISO 22361 | 2022 | https://www.iso.org/standard/50267.html |
| ISO 31000 | 2018 | https://www.iso.org/standard/65694.html |

The parts of ISO/IEC 27035 and 27036, ISO/IEC 27400, ISO/IEC 27402 and
ISO/IEC 27009 are cited without a link; find them by number in the ISO
catalogue.

Related templates: `isms/isms-learning-path`, `isms/isms-glossary`,
`isms/iso-27001-clauses-explained`, `isms/certification-audit-explained`,
`compliance/iso-map`, `isms/control-framework-crosswalk`,
`isms/isms-documented-information-register`, `isms/control-evidence-matrix`.

## Standard and licence note

Structure aligned with ISO/IEC 27000:2026, which gives an overview of the
ISMS family, and with ISO/IEC 27001:2022 + Amd 1:2024 clause 7.5.3 on
external documents. Editions and life-cycle stages come from the ISO
catalogue as checked on 2026-11-01. The summaries, tables, tier advice and
decision rules are original text. No ISO or IEC text, full titles,
clauses, controls or definitions are reproduced; you need the official
standards, sold by ISO, IEC and national standards bodies, to implement
any of them. Editions change: check the current edition and life-cycle
stage of each standard on iso.org before you rely on this map. This is a
documentation format, not certification or legal advice. Template
licence: MIT.