ISO 27002 gives best practise guidance on applying controls, including organisational, physical, people, and technological controls, whereas ISO 27001 is the specification for ISMS, containing risk management process requirements.