Developing organization-specific guidelines

What this part of the catalogue does

Clause 0.5 presents the document as a starting point for an organization's own guidelines: not every control or piece of guidance will apply, and further controls and guidance may be needed for the organization's particular needs and identified risks. Cross-referencing organization-specific documents to the clauses of this document helps later reference.

What it means when you fill the register

The catalogue is generic; an organisation adds its own guidance where its context, technology, sector or regulation demands it. The introduction encourages written organisation-specific guidance beside the generic control, and warns that guidance written once and never reviewed becomes a source of drift. The attribute view is one way to decide where that guidance is needed: a control with an unusual combination of values, or with no detective or corrective value, is a candidate for a closer look. This is our reading, not a requirement in the text. The page states the reading as ours because a buyer should be able to disagree with it. The register can carry a column for the organisation's own guidance, which is usually where the real local knowledge sits. The test of local guidance is whether a new joiner could follow it without asking the author. If not, the attribute value it supports is probably resting on one person's memory. A short review note in the register, naming the author and the date, is usually enough to keep it honest.

Local guidance is where sector rules, technology choices and contractual terms land. A bank, a hospital and a software supplier can all use the same 93 controls and still need different local guidance for the same control. The attribute view helps a reviewer see where the local guidance is doing real work, because a control with an unusual combination of values is usually the one with a local story. The page should not claim that the standard asks for this review; it is our method, and it is offered as one.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method