Answers
Short answers to the questions buyers ask
Each answer opens with the direct answer in under sixty words, then the detail, the source and the link to the record. The pages are the same record as the control pages, written for a reader who has one question.
01The answers
Five questions
What is ISO/IEC 27028?ISO/IEC 27028 is the ISO/IEC guidance on applying the attributes attached to information security controls. It expands the five attributes that ISO/IE...Read the answerIs ISO/IEC 27028 published yet?Not yet. ISO records ISO/IEC 27028 at stage 60.00, under publication, dated 20 October 2026. ISO states that final production steps take up to seven w...Read the answerWhat are the five control attributes in ISO/IEC 27002?The five are control type (preventive, detective, corrective), information security properties (confidentiality, integrity, availability), cybersecuri...Read the answerShould the Statement of Applicability record control attributes?It is not required, but it is useful. The SoA already lists the controls and the reason for inclusion or exclusion. Adding the five attribute columns ...Read the answerDoes ISO/IEC 27028 affect ISO/IEC 27001 certification?No. ISO/IEC 27028 is guidance and is not certifiable. A certificate is issued against ISO/IEC 27001, and guidance does not end it or create a transiti...Read the answer
02The record