Determining controls

What this part of the catalogue does

Clause 0.4 states that which controls to use follows from the organization's decisions after a risk assessment with a defined scope, guided by its risk acceptance criteria, treatment options and overall approach, relevant national and international law, and how controls combine to give defence in depth. Controls may be designed in-house or taken from any source, weighing the resources needed against the business value (ISO/IEC TR 27016 discusses the economics), and balancing spending on controls against the business impact incidents would cause without them; risk assessment results guide management action and priorities. Some controls act as guiding principles for most organizations; ISO/IEC 27005 covers control determination and other treatment options.

What it means when you fill the register

Controls are chosen through risk treatment, and the catalogue is a reference from which the organisation selects. The selection is recorded in the Statement of Applicability, with a reason for inclusion and for exclusion, and the catalogue is not a mandatory list. For the attribute view the SoA is the join: the control code is the key, the justification explains inclusion, and the five attributes sit beside them as a view. Nothing in the attribute work changes the inclusion decision, and no justification needs rewriting to carry attribute values. A buyer who is told otherwise is being sold a rebuild. The safest change is the addition of columns and a version note, with the existing text untouched.

The selection record is the SoA, and the SoA is the only place where the control set, the risk treatment and the justification meet. In practice the attribute work starts here because every other document refers back to it. A buyer who adds attribute columns to a spreadsheet that is not the controlled SoA has created a second, unofficial register. The safer path is to add the columns to the controlled document, version it, and let the spreadsheet be an export of it.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method