Attribute record
Control type: 3 values across the catalogue
Control type describes when and how a control changes the risk of an information security incident. It answers a simple question: does the control act before the event, does it find the event while or after it happens, or does it act afterwards to reduce the damage? ISO/IEC 27002:2022 uses three values, and every one of the 93 controls carries at least one.
What this attribute records
What the control does to the chance or the effect of an incident. It answers a specific question: where would we notice an incident, and what would we do about it?
Control type describes when and how a control changes the risk of an information security incident. It answers a simple question: does the control act before the event, does it find the event while or after it happens, or does it act afterwards to reduce the damage? ISO/IEC 27002:2022 uses three values, and every one of the 93 controls carries at least one.
| Value | Controls | What it means |
|---|---|---|
| Preventive | 83 | Acts before an incident, to stop it happening or to make it less likely. |
| Detective | 13 | Acts when an incident happens or afterwards, to find and report it. |
| Corrective | 14 | Acts after an incident, to reduce its effect and restore the position. |
How to record it without creating a second catalogue
- One column, values from the three published terms, separated by a semicolon where a control carries more than one.
- The reason for a value that differs from Table A.1, in the same row, not in a separate document.
- The evidence that the control acts at that point: a configuration, a log, a test, an incident record.
- The review date, because a redesigned control can move from one type to another.
Errors that cost an audit
- Treating control type as a maturity score. It describes timing, not strength.
- Marking a control preventive because the policy says so, when the only operating evidence is a detective log.
- Leaving a control blank because it seems to fit two types. Two values are allowed and common.
- Using control type as a risk rating. A corrective control is not a weaker control.
The controls behind each value
Every control appears under each value it carries, so a control can appear more than once. The count is a count of rows, not a measure of strength.
Preventive 83
Acts before an incident, to stop it happening or to make it less likely.
5.1 5.10 5.11 5.12 5.13 5.14 5.15 5.16 5.17 5.18 5.19 5.2 5.20 5.21 5.22 5.23 5.27 5.29 5.3 5.31 5.32 5.33 5.34 5.35 5.36 5.37 5.4 5.5 5.6 5.7 5.8 5.9 6.1 6.2 6.3 6.4 6.5 6.6 6.7 7.1 7.10 7.11 7.12 7.13 7.14 7.2 7.3 7.4 7.5 7.6 7.7 7.8 7.9 8.1 8.10 8.11 8.12 8.14 8.18 8.19 8.2 8.20 8.21 8.22 8.23 8.24 8.25 8.26 8.27 8.28 8.29 8.3 8.30 8.31 8.32 8.33 8.34 8.4 8.5 8.6 8.7 8.8 8.9
Detective 13
Acts when an incident happens or afterwards, to find and report it.
Where this attribute is used
Each of the 93 control pages states this value in its attribute table, beside the other four. The kit exports the same value in the same column order, so a register built from it can be filtered by this attribute without reformatting. The free check uses your answer about the five attributes to place the work against your next audit.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.