Background and context

What this part of the catalogue does

Clause 0.1 sets the scene: organizations of every type and size handle information in electronic, physical and spoken form, and its value extends to intangible forms such as knowledge, ideas and brands, so it and the assets around it need protecting against natural, accidental and deliberate risk sources. Security comes from a suitable set of controls (policies, rules, processes, procedures, structures and hardware and software functions) that the organization defines, implements, monitors, reviews and improves; an ISMS as in ISO/IEC 27001 gives a coordinated, risk-based view. Technical measures alone achieve limited security and need management and organizational support, choosing controls takes careful planning during risk treatment, and a working ISMS needs support from all personnel and sometimes shareholders, suppliers and specialists.

What it means when you fill the register

The introduction explains why the catalogue exists. Information is held in electronic, physical and spoken form, and its value goes beyond the obvious records: knowledge, ideas and reputation are information assets too. Technical measures on their own reach only so far, and a working set of controls needs management direction, organisation and a way of choosing, running and reviewing controls over time. For the attribute view the point is that the catalogue is a reference for a management system, not a shopping list. The attributes sort the same catalogue for different readers; they are not a second control set. A buyer who adds attributes should not also add controls, change the scope or reopen the risk treatment. The work is a view of what is already there.

In practice the introduction is the page a new control owner should read first. It explains why the register exists, why a policy on its own is not a control, and why the same control can look different to a risk owner, an operator and an auditor. When a team is stuck on an attribute value, the argument is usually here: they are describing the document rather than the effect. Reading the introduction together, once, is a cheap way to settle the vocabulary before the columns are filled.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method