Attribute record
Cybersecurity concepts: 5 values across the catalogue
This attribute links a control to the functions of the framework of cybersecurity concepts set out in ISO/IEC TS 27110: identify, protect, detect, respond and recover. It is the attribute that makes a control set legible to a security operations audience and to a board that already uses a framework vocabulary. The five values are a view of the control, not a stage in a process: one control can serve more than one function, and a control set should carry all five.
What this attribute records
Which function of the cybersecurity framework the control serves. It answers a specific question: if an incident started today, which function would we be missing?
This attribute links a control to the functions of the framework of cybersecurity concepts set out in ISO/IEC TS 27110: identify, protect, detect, respond and recover. It is the attribute that makes a control set legible to a security operations audience and to a board that already uses a framework vocabulary. The five values are a view of the control, not a stage in a process: one control can serve more than one function, and a control set should carry all five.
| Value | Controls | What it means |
|---|---|---|
| Identify | 23 | Understand the assets, risks and context that the other functions depend on. |
| Protect | 71 | Limit the chance or the effect of an incident while normal operations continue. |
| Detect | 14 | Find and analyse an incident or a weakness. |
| Respond | 11 | Act on an incident to contain and resolve it. |
| Recover | 6 | Restore the capability and learn from the incident. |
How to record it without creating a second catalogue
- One column, with every function the control serves, and the reason for a value that differs from Table A.1.
- A coverage count by function across the full control set, reviewed for gaps.
- The evidence that the function operates: monitoring coverage, response records, recovery tests.
- A note where a function is served outside the ISMS, for example by a service provider.
Errors that cost an audit
- Reading the five values as a maturity ladder. They are functions, not levels.
- Counting a control once when it serves two functions, which understates coverage.
- Assuming a full 93-control set has no gap. Count it by function before saying so.
- Letting a tool's own framework mapping overwrite the published value without a recorded decision.
The controls behind each value
Every control appears under each value it carries, so a control can appear more than once. The count is a count of rows, not a measure of strength.
Identify 23
Understand the assets, risks and context that the other functions depend on.
5.1 5.12 5.19 5.2 5.20 5.21 5.22 5.27 5.31 5.32 5.33 5.34 5.35 5.36 5.4 5.5 5.7 5.8 5.9 8.29 8.30 8.6 8.8
Protect 71
Limit the chance or the effect of an incident while normal operations continue.
5.10 5.11 5.13 5.14 5.15 5.16 5.17 5.18 5.23 5.27 5.29 5.3 5.33 5.34 5.35 5.36 5.37 5.5 5.6 5.8 6.1 6.2 6.3 6.4 6.5 6.6 6.7 7.1 7.10 7.11 7.12 7.13 7.14 7.2 7.3 7.4 7.5 7.6 7.7 7.8 7.9 8.1 8.10 8.11 8.12 8.14 8.17 8.18 8.19 8.2 8.20 8.21 8.22 8.23 8.24 8.25 8.26 8.27 8.28 8.3 8.30 8.31 8.32 8.33 8.34 8.4 8.5 8.6 8.7 8.8 8.9
Detect 14
Find and analyse an incident or a weakness.
5.25 5.28 5.7 6.8 7.11 7.4 8.12 8.15 8.16 8.17 8.20 8.30 8.6 8.7
Respond 11
Act on an incident to contain and resolve it.
Where this attribute is used
Each of the 93 control pages states this value in its attribute table, beside the other four. The kit exports the same value in the same column order, so a register built from it can be filtered by this attribute without reformatting. The free check uses your answer about the five attributes to place the work against your next audit.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.