Structure and annexes

The clauses and annexes around the attribute record

Sixteen structural and introductory units from ISO/IEC 27002:2022: the introduction, scope, terms, structure and the two informative annexes. They carry no control requirement of their own, and they are where the attribute idea is defined and explained.

01The units

All sixteen

Structural and introductory units of ISO/IEC 27002:2022
Code	Title
0.1	Background and context
0.2	Information security requirements
0.3	Controls
0.4	Determining controls
0.5	Developing organization-specific guidelines
0.6	Life cycle considerations
0.7	Related International Standards
1	Scope
2	Normative references
3.1	Terms and definitions
3.2	Abbreviated terms
4.1	Clauses
4.2	Themes and attributes
4.3	Control layout
A	Annex A (informative) Using attributes
B	Annex B (informative) Correspondence of ISO/IEC 27002:2022 with ISO/IEC 27002:2013

Clause 4.2 is the one to read first: it defines the themes and the five attributes. Annex A holds the control matrix. The rest set the vocabulary and the structure the record relies on.

02Why they matter

Why a record includes them

A control page without the clause that defines the vocabulary is a set of rows without a key. The structural units are what make the values stable: clause 4.2 defines the five attributes, clause 4.3 fixes where the values sit on a control, and Annex A shows the matrix. A buyer who reads only the 93 control pages will still get the values, but will not know why two teams can assign different values to the same control.

The five attributes All 93 controls