ISO 27001 clause 2: Normative references

What clause 2 requires in practice

Clause 2 lists the documents that the standard relies on so heavily that part of their content works as a requirement. For ISO 27001:2022 the list is short: it points to the ISO/IEC 27000 overview and vocabulary. The clause explains how to treat references. A dated reference means only the stated edition counts, while an undated reference means the latest edition, with its amendments, applies.

In practice this means an organisation uses the vocabulary from the referenced document when it interprets terms, and it checks which edition is in play before relying on any wording. The clause does not turn every related guidance document into a mandatory one. Guidance on controls, risk management or measurement helps with implementation, but a document that is merely useful does not create audit criteria by being listed elsewhere.

Nothing needs to be produced for clause 2 itself. The expected outcome is that the project team knows which sources carry binding force and which are advice.

Distinguish three different sources

ISO 27001 contains the ISMS requirements used to assess conformity. ISO 27000 supplies the referenced vocabulary and overview. ISO 27002 provides guidance for information security controls. A team can use the latter to understand implementation options without turning each suggested technique into an obligation.

Annex A is a normative annex within ISO 27001. Its control reference set is used through the risk-treatment requirements in clause 6.1.3. Calling Annex A “the normative reference in clause 2” obscures these different relationships. Equally, saying the annex is normative does not mean all 93 controls must automatically be deployed in every organisation.

Apply references without expanding requirements accidentally

The source standard distinguishes dated and undated references: the specified edition governs a dated reference, while the latest edition and amendments apply to an undated one. Keep the basis for your project clear and review applicable updates. This is different from silently replacing ISO 27001 with a draft revision because a blog discusses future changes.

Use authorised sources for definitive wording. A practical source register can record a publication, edition, role and person responsible for keeping it current. The register is an optional way of organising work; clause 2 does not prescribe a special form. Where an external publication is necessary to operate the ISMS, consider the document controls under clause 7.5.3.

Why knowing the reference hierarchy matters

Confusion about what is binding is a steady source of wasted effort. A team that treats every guidance publication as compulsory builds heavy procedures nobody needs, while a team that ignores the vocabulary reference ends up arguing with auditors about what a term means. Customers and certification-seeking organisations also lose time when a consultant's proposal quietly adds extra obligations beyond the standard. Being clear about the sources keeps scope of work accurate, keeps costs predictable and gives an internal auditor a firm basis for deciding whether something is a finding or merely a suggestion.

How to apply clause 2 in your programme

The aim is a short, shared understanding of sources. One practical method is a one-page reading note kept with the project plan; it is a convenience, not something the clause demands.

1. Obtain the current edition of the standard and the referenced vocabulary document through a legitimate source.
2. Note the edition of each in the project plan so later readers know what was used.
3. Separate three groups in your own words: requirements of the standard, vocabulary that gives terms their meaning, and guidance that supports implementation choices.
4. Ask every adviser or supplier to say which group a recommendation belongs to before it is accepted.
5. Check wording in policies and procedures against the vocabulary, correcting terms that mean something different in the standard.
6. Revisit the note whenever a new edition or amendment is published.
7. Keep a short list of questions that need an authoritative answer, such as the meaning of a term or the status of a reference, and route them to one person so interpretations remain consistent across the project.

Evidence an auditor expects for clause 2

Clause 2 rarely draws direct questions, but an auditor may test whether the organisation understands its criteria. Typical evidence is observation and conversation rather than documents.

• An interview in which the ISMS lead explains which sources are binding and which are guidance.
• Records showing which edition of the standard the system was built against.
• Internal audit criteria that quote the standard rather than a consultant's checklist.
• Procedures whose terms match the referenced vocabulary.

A sample of contracts or tender responses can also show that obligations quoted to customers come from the standard itself, not from a supplier's own interpretation.

Common nonconformities and weak points with clause 2

These are patterns an auditor may raise, usually as observations about interpretation rather than formal findings.

Audit teams generally treat these as signs of weak understanding that can grow into larger problems if ignored.

• Internal audits judged against a guidance document as if its suggestions were requirements.
• The system built against an outdated edition, with no record of why.
• Procedures that use security terms loosely, so staff and auditors interpret them differently.
• Supplier proposals that present optional guidance as a compulsory deliverable, which creates unnecessary work.

Illustrative examples

What to check before relying on a source

Check the document identity, edition, amendment status and how the claimed requirement enters your ISMS. A customer contract can create an obligation even where an ISO publication only gives advice; record that contractual basis separately. Do not attribute a customer-specific restriction or a consultant’s preferred method to clause 2.

Useful evidence is the project’s correct understanding and control of its necessary external references. Avoid uncontrolled old standards, copied definitions of uncertain origin and procurement claims that “ISO 27002 certification” is interchangeable with organisational ISO 27001 certification.