Attribute record
Security domains: 4 values across the catalogue
This attribute groups controls into four broad domains. Read them in the order protection, defence, resilience, and governance with the ecosystem around them: that is a coarse view for a board or an executive audience, and the one most likely to be used in a report rather than in a register. The published values are four, and a control can carry more than one.
What this attribute records
The broad security domain the control belongs to. It answers a specific question: which domain would the board ask about first, and can we show the controls behind it?
This attribute groups controls into four broad domains. Read them in the order protection, defence, resilience, and governance with the ecosystem around them: that is a coarse view for a board or an executive audience, and the one most likely to be used in a report rather than in a register. The published values are four, and a control can carry more than one.
| Value | Controls | What it means |
|---|---|---|
| Governance and ecosystem | 27 | Direction, risk, assurance and the relationships with internal and external stakeholders. |
| Protection | 69 | Architecture, administration, identity and access, maintenance, and physical and environmental security. |
| Defence | 22 | Detection and the management of computer security incidents. |
| Resilience | 8 | Continuity of operations and crisis management. |
How to record it without creating a second catalogue
- One column, with every domain the control serves, and the published value kept beside any local value.
- A board-level count by domain, with the controls behind each number.
- A link from the domain to the executive owner, because a domain without an owner is a slide, not a control.
- A note where a domain is served by a group function outside the ISMS scope.
Errors that cost an audit
- Treating the domains as a hierarchy of importance.
- Reporting a domain count without the control list behind it.
- Using the domain as a replacement for the theme, which loses the organisational, people, physical and technological split.
- Letting a dashboard label ('defence') stand in for the published term.
The controls behind each value
Every control appears under each value it carries, so a control can appear more than once. The count is a count of rows, not a measure of strength.
Governance and ecosystem 27
Direction, risk, assurance and the relationships with internal and external stakeholders.
5.1 5.10 5.19 5.2 5.20 5.21 5.22 5.23 5.3 5.31 5.32 5.35 5.36 5.37 5.4 5.8 5.9 6.1 6.2 6.3 6.4 6.5 6.6 8.30 8.34 8.6 8.8
Protection 69
Architecture, administration, identity and access, maintenance, and physical and environmental security.
5.10 5.11 5.12 5.13 5.14 5.15 5.16 5.17 5.18 5.19 5.2 5.20 5.21 5.22 5.23 5.29 5.31 5.34 5.37 5.8 5.9 6.7 7.1 7.10 7.11 7.12 7.13 7.14 7.2 7.3 7.4 7.5 7.6 7.7 7.8 7.9 8.1 8.10 8.11 8.12 8.13 8.14 8.15 8.17 8.18 8.19 8.2 8.20 8.21 8.22 8.23 8.24 8.25 8.26 8.27 8.28 8.29 8.3 8.30 8.31 8.32 8.33 8.34 8.4 8.5 8.6 8.7 8.8 8.9
Where this attribute is used
Each of the 93 control pages states this value in its attribute table, beside the other four. The kit exports the same value in the same column order, so a register built from it can be filtered by this attribute without reformatting. The free check uses your answer about the five attributes to place the work against your next audit.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.