Life cycle considerations

What this part of the catalogue does

Clause 0.6 notes that information passes from creation to disposal and that its value and risks change along the way (published financial accounts no longer need confidentiality but still need integrity), so security matters at every stage. Information systems and other relevant assets also have life cycles, from conception and specification through design, development, testing, implementation, use and maintenance to retirement and disposal, and security should be considered at each stage; new developments and changes are chances to improve controls using the organization's risks and incident lessons.

What it means when you fill the register

Controls have a life cycle: design, implement, operate, monitor, change and retire. The introduction asks the reader to use the catalogue with the life cycle in mind, because a control that was right at design time can become wrong after a change in technology, supplier or threat. For the attribute record the values are not permanent. A control can move from preventive to detective as it is redesigned, and an attribute register without a review date is a snapshot pretending to be a system. Our recommendation is to date the register and review it with the risk treatment plan, so the two documents move together. The record on this site carries its own date, and the change watch exists because the published text will move too.

The life cycle shows up in the review date and in the change log. A control redesigned after an incident may move from preventive to detective, and a control moved to a service provider may keep its value while its evidence moves out of the organisation. A register that is not dated cannot show either change. The cheapest discipline is to review the attribute columns with the risk treatment plan, once a cycle, and to record the date on the register itself rather than in a covering email.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method