Answer
What is ISO/IEC 27028?
ISO/IEC 27028 is the ISO/IEC guidance on applying the attributes attached to information security controls. It expands the five attributes that ISO/IEC 27002:2022 attaches to each of its 93 controls and explains how to define attributes of your own. It is guidance, not a certifiable requirement standard.
What does it cover?
The public abstract says the guidance is about applying those attributes, that it is generic, and that it is for organizations of any type, size or nature. Public commentary on the draft reports a main section on the attribute approach and a section on additional attributes.
Why does it exist?
ISO/IEC 27002:2022 introduced themes and five example attributes. It said an organisation may define its own attributes and values, but it did not explain how. The new guidance is the explanation.
Who is it for?
ISMS managers, CISOs and consultants who already work with the ISO/IEC 27001 control set and want to present, filter or allocate the same controls for different audiences.
What should I do now?
Record the five published values for the controls in your Statement of Applicability, compare them with Table A.1, and decide whether to add attributes of your own. The free check gives you a dated starting point.
Check it yourself
All 93 controls The five attributes The publication record Run the free check
Source for this page
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27001:2022, the certifiable requirements. The management system requirements and Annex A, including the Statement of Applicability in clause 6.1.3.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.