ISO 27001 defines the requirements for establishing and certifying an Information Security Management System. ISO 27002 provides guidance on implementing controls listed in Annex A. Certification applies only to ISO 27001.