No, they do not have to be GFSI but they still are required to meet regulatory guidance and should be able to demonstrate this is some manner via the Approved Supplier Program (2.3.4)
I have always maintained specifications for corrugated master cartons (dimensions, additives, ECT, preprint/color, etc.), However no auditor has ever looked for this beyond direct (primary) packaging but it is a good practice as a continuity measure. Here is the code from 9th ed. without the guidance part:
220.127.116.11 Verification of packaging shall include a certification of all packaging that comesinto direct contact with food meets either regulatory acceptance or approval criteria.Documentation shall either be in the form of a declaration of continued guaranteeof compliance, a certificate of conformance, or a certificate from the applicableregulatory agency.In the absence of a certificate of conformance, certificate of analysis, or letter ofguarantee, analyses to confirm the absence of potential chemical migration from thepackaging to the food contents shall be conducted and records maintained.