Five ways to view the same 93 controls

What the five have in common

They are views, not requirements. A control belongs to one theme (organisational, people, physical or technological) and carries values from all five attributes. The values are written with a leading hash in the standard so they can be searched; the register does not need the hash, only the value.

None of the five is mandatory in the sense of a certification requirement, and an organisation may define attributes of its own as well as, or instead of, these. What the guidance adds is the method: how to use the five, and how to define a sixth when the five do not answer the question.

The definition of each attribute, in plain words, is on its own page, with every published value and the controls behind each one. Read the definition before you fill a column: most value disagreements are a disagreement about the definition.

Attribute types and the number of values in the published set

Attribute	Values	Controls carrying it	What it answers
Control type	3	93	Where would we notice an incident, and what would we do about it?
Information security properties	3	93	Which property would we lose first if this control failed?
Cybersecurity concepts	5	93	If an incident started today, which function would we be missing?
Operational capabilities	15	93	Who does this work, and do they know they own it?
Security domains	4	93	Which domain would the board ask about first, and can we show the controls behind it?

Every published value

Control type

Control type describes when and how a control changes the risk of an information security incident. It answers a simple question: does the control act before the event, does it find the event while or after it happens, or does it act afterwards to reduce the damage? ISO/IEC 27002:2022 uses three values, and every one of the 93 controls carries at least one.

• Preventive Acts before an incident, to stop it happening or to make it less likely.
• Detective Acts when an incident happens or afterwards, to find and report it.
• Corrective Acts after an incident, to reduce its effect and restore the position.

Information security properties

This attribute describes which property of information the control contributes to keeping: confidentiality, integrity or availability. It is the oldest vocabulary in the family, and it is the one most often recorded loosely. The published values are the three properties of the classic triad, and a control can carry more than one, because a backup protects availability and integrity at the same time.

• Confidentiality Information is not made available or disclosed to people or processes that are not authorised.
• Integrity Information is accurate, complete and protected against unauthorised change.
• Availability Information is accessible and usable when it is needed.

Cybersecurity concepts

This attribute links a control to the functions of the framework of cybersecurity concepts set out in ISO/IEC TS 27110: identify, protect, detect, respond and recover. It is the attribute that makes a control set legible to a security operations audience and to a board that already uses a framework vocabulary. The five values are a view of the control, not a stage in a process: one control can serve more than one function, and a control set should carry all five.

• Identify Understand the assets, risks and context that the other functions depend on.
• Protect Limit the chance or the effect of an incident while normal operations continue.
• Detect Find and analyse an incident or a weakness.
• Respond Act on an incident to contain and resolve it.
• Recover Restore the capability and learn from the incident.

Operational capabilities

This attribute places a control in one or more of the operational areas that security practitioners recognise, such as governance, asset management, identity and access management, or continuity. It is the attribute most useful for allocating work, because it maps a control to a team, a budget line and a skill set. ISO/IEC 27002:2022 uses fifteen values, and a control can sit in more than one area.

• Governance Direction, policy, roles, risk and assurance.
• Asset management Knowing what information and assets exist and who owns them.
• Information protection Classification, handling, labelling and transfer.
• Human resource security People, roles, screening, terms and change of employment.
• Physical security Premises, equipment and the physical environment.
• System and network security Networks, systems, architecture and segregation.
• Application security Applications, development and secure coding.
• Secure configuration Hardening, baselines and configuration control.
• Identity and access management Identity, authentication and authorisation.
• Threat and vulnerability management Threat intelligence, vulnerabilities and technical assessment.
• Continuity Continuity, backup and recovery.
• Supplier relationships security Suppliers, services and the supply chain.
• Legal and compliance Legal, regulatory, contractual and compliance review.
• Information security event management Logging, monitoring, incidents and evidence.
• Information security assurance Independent review, audit and measurement.

Security domains

This attribute groups controls into four broad domains. Read them in the order protection, defence, resilience, and governance with the ecosystem around them: that is a coarse view for a board or an executive audience, and the one most likely to be used in a report rather than in a register. The published values are four, and a control can carry more than one.

• Governance and ecosystem Direction, risk, assurance and the relationships with internal and external stakeholders.
• Protection Architecture, administration, identity and access, maintenance, and physical and environmental security.
• Defence Detection and the management of computer security incidents.
• Resilience Continuity of operations and crisis management.

Adding an attribute of your own

The standard allows attributes of your own as well as, or instead of, the five examples. A local attribute is legitimate when it is defined, has a closed set of values, is recorded for every control in scope and has an owner. The test is whether two people would assign the same value to the same control without talking to each other.

Useful local attributes tend to answer a question the five do not: which asset or service the control protects, which risk treatment it serves, which jurisdiction or contract it satisfies, or which assurance activity tests it. A local attribute that duplicates a published one adds a column without adding a view.

This is our method, not a list from the standard. The draft's additional attributes are not public, and this site does not present a list as if it were the standard's.

How the values are recorded

1. One column per attribute, beside the control code and name, not at the end of a justification.
2. The published value first, then your own value where it differs, then the reason for the difference.
3. Every value the control actually carries, not only the dominant one, because a count by value is only as good as the rows.
4. An owner and a review date, because a control can change type when it is redesigned or outsourced.
5. The evidence behind the value, because an attribute is a claim about how the control behaves.

Run the free attribute check See all 93 controls