ISO 27001 vs 27002

I have never been through an ISO 27001 audit, but need to prepare for one. In comparing the annex controls in 27001 with 27002 details I find a pretty significant difference. Which one, or are both, required for us to implement?

For example; ISO 27001 A.12.2.1 Detection, prevention and recovery controls to protect against malware shall be implemented, combined with appropriate user awareness. Fairly general. But an anti-malware utility combined with an response process to malware scenarios could sufficiently meet …

cybersecurity iso iso 27001 vs