Key Facts
- Regulator
- ISO/IEC JTC 1/SC 27 (published by ISO and IEC)
- Latest version
- ISO/IEC 27003:2017 (Edition 2), 'Information technology — Security techniques — Information security management systems — Guidance'; revision under way (Edition 3, ISO/IEC DIS 27003)
- Effective
- 12 April 2017
- Official text
- www.iso.org ↗
What is ISO/IEC 27003?
ISO 27003, formally ISO/IEC 27003, is the international guidance standard that explains how to apply the requirements of ISO/IEC 27001, the information security management system (ISMS) standard. ISO and IEC publish it through committee JTC 1/SC 27. It is written for any organisation building, running or improving an ISMS.
The current version is ISO/IEC 27003:2017 (Edition 2), Information technology — Security techniques — Information security management systems — Guidance, with an effective date of March 2017. ISO describes it as explanation and guidance on ISO/IEC 27001:2013. It runs to 45 pages and replaced ISO/IEC 27003:2010, which has been withdrawn.
A revision is under way. ISO has listed the 2017 edition at stage 90.92, "to be revised", since 29 January 2024. Its replacement, ISO/IEC DIS 27003 (Edition 3), was registered as a Draft International Standard on 2 October 2026 and is in the enquiry phase with ISO members. It is retitled Information security management systems — Guidance for the application of ISO/IEC 27001:2022. Until it publishes, the 2017 edition is the one to cite.
Guidance only helps if it matches the standard you are assessed against.
Why it matters
ISO/IEC 27001 states what an ISMS must do. It is short on what that looks like inside a real organisation. ISO/IEC 27003 is the published explanation that fills the gap.
The tension is familiar to anyone writing a first ISMS: the requirement reads clearly, and the evidence is a blank page. ISO/IEC 27003 is where you check what a requirement is getting at before you write it down.
Two reasons people meet it:
- A neutral reference for intent. When a requirement can be read two ways, ISO's own guidance is a better starting point than someone's opinion.
- The move to the 2022 edition. The draft third edition is written for ISO/IEC 27001:2022, so teams on the current edition of ISO/IEC 27001 will want the new text once it publishes.
Who it applies to
ISO/IEC 27003 applies to organisations that are building, running or improving an ISMS against ISO/IEC 27001. The ISO record does not limit it by organisation size or sector. It is of little use to a firm with no ISMS and no plan to have one.
Obligation: none that we have found. ISO/IEC 27003 is guidance on ISO/IEC 27001, not a set of requirements, and the sources checked name no law or regulator that makes it mandatory. Treat it as voluntary unless a customer contract or tender names it.
ISO/IEC 27001 is the requirements standard and ISO/IEC 27003 explains it, so start with the ISO 27001 vault and read ISO/IEC 27003 alongside it.
The UK position
A UK firm meets ISO/IEC 27003 as a companion to ISO 27001 work, not as a legal duty. The sources checked name no UK statute or regulator that requires it.
The usual way in is a customer or tender that asks for ISO 27001. ISO/IEC 27003 is then reading material for the team doing the work.
Key requirements
ISO/IEC 27003 sets no requirements of its own; it explains the ones in ISO/IEC 27001. The standard is paywalled, so this page describes it at the level of the public abstract and does not reproduce the text.
The ISMS topics from ISO/IEC 27001 that the guidance is used to interpret include:
- context of the organisation, meaning the issues and interested parties that shape the ISMS;
- leadership commitment and the policy that follows from it;
- risk assessment and risk treatment;
- documented information, meaning what must be written down and kept;
- performance evaluation: monitoring, internal audit and management review;
- continual improvement of the ISMS.
For clause-by-clause detail, use the standard itself.
Guidance explains a requirement. It does not satisfy one.
What the third edition changes
ISO/IEC DIS 27003 will replace the 2017 edition. Its title ties it to ISO/IEC 27001:2022 rather than the 2013 edition that the 2017 text explains, and the draft runs to 50 pages against 45. The draft's ISO page still carries the 2017 abstract, so ISO has not yet said publicly what else changes.
Frequently asked questions
ISO/IEC 27001 sets the requirements for an information security management system, including its Annex A controls. ISO/IEC 27002 gives guidance on those information security controls. ISO/IEC 27003 gives guidance on the management-system requirements themselves, such as context, leadership, risk and improvement. Only ISO/IEC 27001 is certifiable; the other two are reading for the team that is meeting it.
No. There is no ISO/IEC 27003:2022. The current edition is ISO/IEC 27003:2017, and the third edition, registered as a Draft International Standard in October 2026, is written for ISO/IEC 27001:2022. ISO dates each edition by the year it is published, so the new ISO 27003 will carry its own publication year, not 2022.
Yes, with care. ISO/IEC 27003:2017 was written for the 2013 wording of ISO/IEC 27001, so read each piece of guidance against the 2022 text and follow the 2022 requirement where the two differ. Certification audits now assess against ISO/IEC 27001:2022, so the requirement, not the older guidance, decides what an auditor expects to see.
No. We found no law or regulator that makes ISO/IEC 27003 mandatory, and ISO presents it as guidance rather than requirements. Where a duty exists, it usually comes from a customer contract or tender that names ISO/IEC 27001. ISO 27003 is then optional reading that helps a team meet that standard, not a separate obligation.
No. ISO/IEC 27003 sets no requirements to assess against, so there is no certificate for it. Certification is to ISO/IEC 27001, issued by a certification body; in the UK, UKAS accredits those bodies. An auditor judges the ISMS against the requirements of ISO/IEC 27001, so not following a piece of ISO/IEC 27003 guidance is not, by itself, a nonconformity.