Skip to main content
Control Institute
Category: Standards and Frameworks

ISO/IEC 27011

Also known as: ISO 27011, ISO/IEC 27011:2024, ISO/IEC 27011:2016
Simply put

ISO/IEC 27011 is a guidance document that helps telecommunications organizations put information security controls in place. It builds on the general control guidance found in ISO/IEC 27002 but adds interpretations and additions specific to the telecom sector. It is a supporting guideline rather than a standalone certifiable standard.

Formal definition

ISO/IEC 27011 is a sector-specific guidance standard within the ISO/IEC 27000 family that provides guidelines supporting the implementation of information security controls in telecommunications organizations. According to the evidence, it provides a common set of information security controls based on ISO/IEC 27002, supplemented with telecommunications sector-specific guidance. It is intended to be used alongside the ISMS requirements framework and control guidance rather than as an independently certifiable requirements standard; organizations pursuing certification are generally certified against ISO/IEC 27001 (the ISMS requirements), with ISO/IEC 27011 informing control selection and implementation for telecom contexts. The standard has appeared in multiple editions (including 2008, 2016, and 2024 versions per the evidence), so practitioners should specify the applicable edition, as content and control references vary by version and by the underlying ISO/IEC 27002 edition it draws upon.

Why it matters

Telecommunications providers occupy a distinctive position in the security landscape: they operate critical infrastructure, carry the traffic of countless downstream organizations, and handle large volumes of sensitive customer and network data. General-purpose control guidance such as ISO/IEC 27002 does not always speak directly to sector-specific concerns like network availability, interconnection, or the confidentiality of communications. ISO/IEC 27011 matters because it bridges that gap, offering a common set of information security controls based on ISO/IEC 27002 but supplemented with interpretations and additions tailored to the telecommunications context.

For organizations in this sector, that specialization helps translate broad control objectives into implementation guidance that reflects how telecom services actually operate. It is important to understand, however, what the standard is and is not. ISO/IEC 27011 is a supporting guideline, not an independently certifiable requirements standard. Organizations seeking certification are generally certified against ISO/IEC 27001, the ISMS requirements standard, with ISO/IEC 27011 informing how controls are selected and implemented for telecom-specific risks. Adopting ISO/IEC 27011 does not, on its own, produce a certificate.

Practitioners should also be attentive to edition and version. The standard has appeared in multiple editions, including 2008, 2016, and 2024 versions per the available evidence, and its content and control references vary by edition and by the underlying ISO/IEC 27002 edition it draws upon. Because control numbering and structure in ISO/IEC 27002 changed with its own revisions, the applicable edition should always be specified so that control references align correctly.

Who it's relevant to

Telecommunications providers
Organizations delivering telecommunications services are the primary audience. ISO/IEC 27011 helps them implement information security controls suited to their sector by supplementing ISO/IEC 27002 with telecom-specific guidance. It supports control selection and implementation but does not replace ISO/IEC 27001 as the certifiable ISMS requirements standard.
Compliance and GRC teams in the telecom sector
Teams managing an ISO/IEC 27001-based ISMS in a telecommunications environment can use ISO/IEC 27011 to interpret general control guidance for their operating context. Because the standard exists in multiple editions and depends on the underlying ISO/IEC 27002 version, these teams should specify the applicable edition when documenting control selections and their Statement of Applicability.
Auditors and assessors working with telecom clients
Certification body auditors and internal assessors evaluating telecommunications organizations should recognize that ISO/IEC 27011 is guidance informing control implementation, not a certifiable requirements standard in its own right. Certification is assessed against ISO/IEC 27001, with ISO/IEC 27011 helping contextualize how controls are applied for telecom-specific risks.
Security architects and engineers in telecommunications
Technical staff responsible for designing and operating telecom security controls can use ISO/IEC 27011 to align implementation with sector-specific guidance built on ISO/IEC 27002. They should confirm which edition of the standard applies, as content and control references vary by version.

Inside ISO/IEC 27011

Sector-specific guidance
ISO/IEC 27011 provides implementation guidance for information security controls tailored to telecommunications organizations, building upon the foundational standards rather than replacing them.
Relationship to ISO/IEC 27002
It supplements the control guidance found in ISO/IEC 27002 by interpreting and extending those reference controls for the telecommunications context; it is a guidance document rather than a certifiable requirements standard.
Relationship to ISO/IEC 27001
It supports organizations implementing an ISMS under ISO/IEC 27001 by informing the selection and application of controls, but certification itself is assessed against the ISO/IEC 27001 requirements in clauses 4 through 10, not against this guidance document.
Telecommunications context
The guidance addresses considerations that are relevant to telecommunications service providers, so its applicability depends on an organization's scope and sector.

Common questions

Answers to the questions practitioners most commonly ask about ISO/IEC 27011.

Is ISO/IEC 27011 a certification standard I can be certified against?
No. ISO/IEC 27011 is a guidance document that provides sector-specific implementation guidance for telecommunications organizations, not a certifiable requirements standard. Certification is obtained against ISO/IEC 27001, whose certifiable requirements sit in clauses 4 through 10. ISO/IEC 27011 supports the interpretation and application of controls within that ISMS context but does not itself serve as the basis for a certificate issued by an accredited certification body.
Does ISO/IEC 27011 replace ISO/IEC 27002 for telecommunications organizations?
No. ISO/IEC 27011 does not replace ISO/IEC 27002; it complements it. ISO/IEC 27002 provides general implementation guidance on reference controls, and ISO/IEC 27011 layers sector-specific interpretation for the telecommunications context on top of that. Organizations in this sector typically use both together rather than treating one as a substitute for the other. Neither document is itself certifiable.
How does ISO/IEC 27011 relate to an ISO/IEC 27001 ISMS implementation?
In most telecommunications engagements, ISO/IEC 27011 is used to inform how controls are interpreted and applied within an ISMS built to ISO/IEC 27001. The ISMS requirements and the risk assessment process remain governed by ISO/IEC 27001 clauses 4 through 10, and control selection is documented through the Statement of Applicability. ISO/IEC 27011 provides context that can help justify and refine those choices, depending on scope.
When would a telecommunications organization choose to reference ISO/IEC 27011?
Organizations typically reference ISO/IEC 27011 when they want sector-specific guidance to interpret controls in ways relevant to telecommunications operations. Whether and how extensively it is applied depends on the organization's scope, risk assessment outcomes, and the judgment of those responsible for the ISMS. It is a supporting resource rather than a mandatory element of certification.
Should ISO/IEC 27011 be cited in the Statement of Applicability?
The Statement of Applicability documents which reference controls are included or excluded and the justification for those decisions under ISO/IEC 27001. Where ISO/IEC 27011 guidance has informed how a control is interpreted or implemented, organizations may reference it as supporting rationale. Practice varies by organization and certification body, so confirm expectations within your specific engagement rather than assuming a fixed convention.
Does using ISO/IEC 27011 change the ISO/IEC 27001 certification scope or audit process?
Using ISO/IEC 27011 does not alter the certifiable requirements or the audit process, which remain governed by ISO/IEC 27001. The certificate still covers only the defined scope of the ISMS. ISO/IEC 27011 may influence how controls are described and implemented within that scope, but the certification decision continues to rest on conformity with ISO/IEC 27001 as assessed by the accredited certification body.

Common misconceptions

Organizations can be certified against ISO/IEC 27011.
ISO/IEC 27011 is guidance that supplements ISO/IEC 27002. Certification is issued by an accredited certification body against the ISO/IEC 27001 ISMS requirements; a supplementary guidance standard is not itself a certifiable requirements standard.
ISO/IEC 27011 replaces ISO/IEC 27002 for telecommunications companies.
It supplements and interprets the ISO/IEC 27002 control guidance for the telecommunications sector rather than replacing it; practitioners typically use it alongside the underlying standards.
Following ISO/IEC 27011 automatically satisfies SOC 2 Trust Services Criteria.
The frameworks are distinct. SOC 2 is an attestation examination performed by a licensed CPA firm under SSAE 18, and mapping between ISO-based control guidance and the Trust Services Criteria is partial at best; satisfying one does not automatically satisfy the other.

Best practices

Treat ISO/IEC 27011 as supplementary guidance to be applied together with ISO/IEC 27002 and the ISO/IEC 27001 ISMS requirements, not as a standalone certifiable standard.
Confirm that the sector-specific guidance is relevant to your defined ISMS scope before investing effort, since applicability depends on whether your organization operates in the telecommunications context.
Continue to drive control selection through your risk assessment and Statement of Applicability under ISO/IEC 27001, using ISO/IEC 27011 to inform how controls are interpreted for telecommunications.
Cite the specific edition of any referenced ISO standard when documenting your control set, since guidance and control structures can change between revisions.
If you also pursue a SOC 2 report, perform a deliberate, documented mapping exercise rather than assuming ISO-based work carries over, recognizing that any mapping is partial.
Engage your accredited certification body early to confirm how sector guidance is expected to be evidenced within the scope of your ISMS certification.