Operational capabilities: 15 values across the catalogue

What this attribute records

The operational area a practitioner would place the control in. It answers a specific question: who does this work, and do they know they own it?

This attribute places a control in one or more of the operational areas that security practitioners recognise, such as governance, asset management, identity and access management, or continuity. It is the attribute most useful for allocating work, because it maps a control to a team, a budget line and a skill set. ISO/IEC 27002:2022 uses fifteen values, and a control can sit in more than one area.

The values of Operational capabilities in the published set

Value	Controls	What it means
Governance	8	Direction, policy, roles, risk and assurance.
Asset management	16	Knowing what information and assets exist and who owns them.
Information protection	15	Classification, handling, labelling and transfer.
Human resource security	6	People, roles, screening, terms and change of employment.
Physical security	16	Premises, equipment and the physical environment.
System and network security	17	Networks, systems, architecture and segregation.
Application security	12	Applications, development and secure coding.
Secure configuration	6	Hardening, baselines and configuration control.
Identity and access management	11	Identity, authentication and authorisation.
Threat and vulnerability management	3	Threat intelligence, vulnerabilities and technical assessment.
Continuity	6	Continuity, backup and recovery.
Supplier relationships security	7	Suppliers, services and the supply chain.
Legal and compliance	6	Legal, regulatory, contractual and compliance review.
Information security event management	10	Logging, monitoring, incidents and evidence.
Information security assurance	4	Independent review, audit and measurement.

How to record it without creating a second catalogue

• One column, with every capability the control serves, because a control often crosses two teams.
• The team and the owner that the value implies, so the register can be allocated.
• A count by capability across the full set, as a workload and coverage view.
• A note where a capability is outsourced, with the contract reference and the retained accountability.

Errors that cost an audit

• Using the capability as a substitute for an owner name.
• Allowing one team to claim every control, which hides the capabilities nobody owns.
• Confusing the capability with the theme: organisational, people, physical and technological are the themes, not capabilities.
• Recording a capability the organisation does not actually perform.

The controls behind each value

Every control appears under each value it carries, so a control can appear more than once. The count is a count of rows, not a measure of strength.

Where this attribute is used

Each of the 93 control pages states this value in its attribute table, beside the other four. The kit exports the same value in the same column order, so a register built from it can be filtered by this attribute without reformatting. The free check uses your answer about the five attributes to place the work against your next audit.

All 93 controls The other attributes