Answer
What are the five control attributes in ISO/IEC 27002?
The five are control type (preventive, detective, corrective), information security properties (confidentiality, integrity, availability), cybersecurity concepts (protect, detect, respond, recover and identify), operational capabilities (fifteen practitioner areas) and security domains (protection, defence, resilience and governance with the ecosystem).
Where are they defined?
ISO/IEC 27002:2022 clause 4.2 defines the five and Annex A Table A.1 gives every control's values. Each value is written with a leading hash so it can be searched.
How many values are there?
Three control types, three properties, five concepts, fifteen operational capabilities and four security domains. A control can carry more than one value in any attribute.
Are they mandatory?
They are the examples the catalogue uses. An organisation may define attributes of its own as well as, or instead of, these five, provided it defines and records them.
How do I record them?
Add one column per attribute beside the control code and name, keep the published value visible, and record any local value and the reason for the difference.
Check it yourself
All 93 controls The five attributes The publication record Run the free check
Source for this page
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27001:2022, the certifiable requirements. The management system requirements and Annex A, including the Statement of Applicability in clause 6.1.3.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.