Information security requirements

What this part of the catalogue does

Clause 0.2 says an organization must work out its own security requirements and names three sources: an assessment of risks to the organization in light of its strategy and objectives, leading to the controls needed to bring residual risk within its acceptance criteria; the legal, regulatory and contractual obligations the organization and its partners and providers must meet, together with their socio-cultural environment; and the principles, objectives and business requirements the organization has set for handling information across its life cycle.

What it means when you fill the register

Requirements come from the organisation's own needs and from laws, regulations and contracts. The introduction separates the requirement (what must be protected and why) from the control (how it is protected), and places risk assessment and treatment between the two. For the attribute work this is the line that keeps the buyer honest. Adding an attribute value does not create a requirement, and a missing attribute does not create a gap in the requirement. The requirement set is owned by the management system; the attribute is a label on the control that meets it. That distinction matters when an auditor asks why a control is included and why it carries a particular value: the first answer is the justification, the second is the attribute record.

The split between requirement and control shows up in the Statement of Applicability every audit cycle. A row says the control is included because a risk treatment plan needs it, and the justification explains the need. The attribute is a third thing: a label on how the control behaves. Keeping the three apart stops a team from arguing about an attribute value as if it were a change to the requirement, and stops an auditor from reading a local value as an admission that the control is wrong.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method