ISO 27001 is the central framework of the ISO 27000 series. ISO 27001 is the standard that defines how to implement an information security management system. It is made up of a series of clauses, of which, clauses 4-10 define the management system requirements and Annex A, which defines the information security controls that can be used to address risks identified.
ISO 27002 provides detail on the security controls, as while they are listed in Annex A of 27001, the information provided is very limited. In particular, it describes how to implement it and the objectives of the controls. It is important to note that an organisation cannot certify to ISO 27002, because it’s only a supplementary standard. It is only possible to achieve certification to ISO 27001.