No. It contains guidance. The word requirement belongs to ISO/IEC 27001:2022. A 27003 page may describe what good practice looks like, but it cannot create an obligation, and an auditor cannot raise a nonconformity against it.
The short answer, expanded
No. It contains guidance. The word requirement belongs to ISO/IEC 27001:2022. A 27003 page may describe what good practice looks like, but it cannot create an obligation, and an auditor cannot raise a nonconformity against it.
What to do next
The free check turns this answer into a dated reading for your organization. The register gives you the clause or control behind the answer. If the question is about a customer or a tender, answer with the requirement standard and the certificate, not with a draft.
Run the free check Open the register
Related questions
Why do people call it a requirement?
Because guidance documents often use imperative language. The status of the document decides, not the verb.
Can a contract make it binding?
A contract can cite anything. If it cites 27003, the obligation comes from the contract, not the standard.
What is binding?
The contract, the law and the certification scheme. The requirement standard is the audit criterion.