Answer
Does ISO/IEC 27028 affect ISO/IEC 27001 certification?
No. ISO/IEC 27028 is guidance and is not certifiable. A certificate is issued against ISO/IEC 27001, and guidance does not end it or create a transition deadline. A certification body sets its own audit approach, so the practical step is to ask it how it will treat the guidance.
Is there a transition deadline?
No. There is no date by which an organisation must adopt the attribute view. The publication date is when the text becomes available, not a compliance deadline.
Will my auditor ask about it?
Possibly. An auditor may ask how the control set is presented to different audiences, and the attribute view is one answer. It is not a new clause requirement.
What should I tell the board?
That the standard is guidance, that the certificate is unaffected, and that the practical question is whether the SoA should carry attribute columns this cycle. The free check gives a dated answer.
Check it yourself
All 93 controls The five attributes The publication record Run the free check
Source for this page
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27001:2022, the certifiable requirements. The management system requirements and Annex A, including the Statement of Applicability in clause 6.1.3.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.