Free record and checker
ISO 27028 is here. The attribute record is the work.
ISO/IEC 27028 gives guidance on using the control attributes that ISO/IEC 27002:2022 attaches to its 93 controls. This site records all five attributes for all 93 controls in our own words, with the evidence an auditor asks for, the public record of the standard's stage and dates, and a free check that tells you what to do before your next audit.
Read from the real rules, not invented. Every answer ISO 27028 Revision Checker gives points to the official rule behind it, so you can check any line yourself.
Read from the real rules93 controls behind itCheck any line yourself
Run the free attribute checkRead the 93-control record
No account, no email, no upload. The six answers stay in your browser. The check is computed from the record on this site and states the rule it used.
The record at a glance
- Standard
- ISO/IEC 27028, Edition 1
- Subject
- Guidance on using information security control attributes
- Committee
- ISO/IEC JTC 1/SC 27
- Status
- Stage 60.00, under publication, 20 October 2026
- Publication window
- up to seven weeks, so by 8 December 2026
- Certifiable
- No, it is guidance
- Held catalogue
- ISO/IEC 27002:2022, 93 controls
- Attribute values
- 93 controls x five attributes
The publication window is our arithmetic from ISO's own statement, not an announced date. Read the record.
Are you ready for the attribute question?
Six answers, one date, a verdict and three dated actions. The check reads your Statement of Applicability and your next audit date against the published attribute set. It does not score you, it does not call you compliant, and it does not ask for a file.
- Current position. Whether the five attributes are recorded, partly recorded or not there.
- The next audit. Whether the audit falls before or after the publication window, and which actions are due now.
- Three controls to read. Chosen from the record by your answers, with the evidence each one needs.
What ISO/IEC 27028 does, in plain words
It expands the attribute idea that ISO/IEC 27002:2022 introduced. Each of the 93 controls in that catalogue carries five attributes: a control type, the information security properties it protects, the cybersecurity concept it serves, the operational capability it belongs to and the security domain it sits in. The new guidance explains how to use those five, and how to define attributes and attribute values of your own where the five do not answer your question.
It is a guidance standard in the ISO/IEC 27000 family. It is not certifiable, it does not replace ISO/IEC 27002:2022, and it creates no transition deadline. The buyer's practical question is narrower: should the Statement of Applicability carry the values this cycle, who fills them, and what evidence sits behind each one. That is what this site helps you decide.
The five attributes, and where each value comes from
The record covers 5 attribute types and 3, 3, 5, 15, 4 values across the 93 controls. Every value below is the published value, stated in our own words and cited to its clause.
One page for each of the 93 controls
Each control page states the requirement in our own words, the five published attribute values in a table, the evidence an auditor asks for, the gaps that are commonly found and what the new guidance changes for that control. The pages are server rendered, so a reader or a search engine gets the whole record without running anything.
Published yet? No, and the record says why
ISO records ISO/IEC 27028 at stage 60.00, under publication, dated 20 October 2026. The FDIS ballot opened on 24 August 2026 and closed on 20 October 2026. ISO states that final production steps take up to seven weeks, which puts the latest expected publication date at 8 December 2026. That is our arithmetic, not an ISO date, and the page labels it that way.
There is no transition deadline. A certificate is issued against ISO/IEC 27001, and guidance does not end it. What changes on publication is the text you can read: the five definitions and any additional attributes move from a draft to a published standard, and the register should be checked against it.
What the USD 799 kit contains
The kit is a document set, not a subscription. It holds a 109-row attribute register with all five values for the 93 controls and the 16 structural units, the 550-item evidence list, a dated plan to publication and the next audit, the attribute extension worksheet and the change statement, as PDF, CSV and XLSX. The register keeps the published value and your own value in separate columns, so a deliberate divergence has somewhere to live.
The five-row specimen is free, labelled, and downloadable without an account. The kit arrives by one click to checkout, with no sign-in form before the payment page.
What the change watch does
USD 49 a month. An email when the ISO stage, the dates, the record or the guidance changes, with the diff that changed it. The watch is for the weeks around publication and the first correction, when a register built on this record needs to know that the text moved. It does not watch your own SoA, your audit dates or your supplier list.
Questions buyers ask
Is ISO/IEC 27028 published?
Not yet. ISO records it at stage 60.00, under publication, dated 20 October 2026, and states that final production steps take up to seven weeks. The last published stage before that was 50.60, close of voting, on the same day.
Does it change my ISO/IEC 27001 certificate?
No. ISO/IEC 27028 is guidance, not a certifiable requirement standard. Certification is against ISO/IEC 27001, and new guidance does not end a certificate or create a transition deadline. Certification bodies set their own audit approach, so ask yours.
What are the five control attributes?
Control type (preventive, detective, corrective), information security properties (confidentiality, integrity, availability), cybersecurity concepts (protect, detect, respond, recover and identify), operational capabilities (fifteen values) and security domains (protection, defence, resilience and governance with the ecosystem).
What does the guidance add to ISO/IEC 27002?
It expands how to use the five attributes and how to define attributes and attribute values of your own. Public commentary reports two main sections, an attribute approach and additional attributes. The draft body is not public, so this site does not list the additional attributes as if they were the standard's.
Do I have to add attribute columns to my Statement of Applicability?
No. Nothing in a guidance standard makes a column mandatory, and there is no transition deadline. The practical reason to add them is that an auditor or a board can then see the same control set from another angle without a second catalogue.
What is in the USD 799 kit?
A 109-row attribute register with all five values for 93 controls and the 16 structural units, the evidence list, a dated plan to publication and the next audit, and an attribute extension worksheet, as PDF, CSV and XLSX. The five-row specimen is free.
Is this the ISO text?
No. It is a reference and a checker in our own words, with a source line on every page. The FDIS body is not public and is not quoted. The five attribute values come from the ISO/IEC 27002:2022 record.
The rules this is built from
Nothing here is invented. The record below is the one this site reads, clause by clause, and every line points to the one it came from.
- ISO/IEC 27002:2022
93 controls across four themes, each with five attribute values and the evidence an auditor asks for - ISO/IEC 27028
Edition 1, stage 60.00 under publication on 20 October 2026; the public record of the standard this site is named for
The ISO/IEC 27028 body is not public. This site states the public record and does not present a requirement from the draft as if it were the published text.