ISO 27001: ISMS – Standards Q2

• ISO / IEC 27001 : 2005 

1.  A specification (specifies requirements for implementing, operating, monitoring, reviewing, maintaining & improving a documented ISMS) 
2.  Specifies the requirements of implementing of Security control, customized to the needs of individual organization or part thereof.
3. Used as basis for certification
4. ISO / IEC 27002 : 2005 (Originally ISO/IEC 17799:2005)

1.  A code of practice for Information Security management 
2.  Provides best practice guidance
3.  Use as required within your
4.  Not for certification

Both ISO 27001 and 27002 security control clauses are fully harmonized.