Is NyvMarketing required to follow the guidelines of ISO/IEC 27002 to attain ISO/IEC 27001 certification?

ISO/IEC 27001:2022 is the certifiable standard for Information Security Management Systems (ISMS). While ISO/IEC 27002 provides guidelines and best practices to help organizations implement the controls listed in Annex A of ISO/IEC 27001, it is not mandatory to follow ISO/IEC 27002 to achieve ISO/IEC 27001 certification. Instead, organizations must select and implement appropriate controls from Annex A, or other controls as necessary, based on their risk assessment. ISO/IEC 27002 serves as guidance but is not itself an auditable or certifiable requirement.

"The controls listed in Annex A are not exhaustive and additional controls may be needed. ISO/IEC 27002 provides implementation guidance and is not mandatory for certification against ISO/IEC 27001."

— ISO/IEC 27001:2022, Introduction and Clause 6.1.3; ISO/IEC 27002:2022, Foreword