Related International Standards

What this part of the catalogue does

Clause 0.7 places the document within the ISO/IEC 27000 family: other members give complementary advice or requirements on managing information security, ISO/IEC 27000 gives the overview and shared vocabulary, and sector standards add controls for particular fields: cloud (ISO/IEC 27017), privacy (ISO/IEC 27701), the energy utility sector (ISO/IEC 27019), telecommunications operators (ISO/IEC 27011) and health (ISO 27799). These appear in the Bibliography and some are referenced in the guidance of Clauses 5 to 8.

What it means when you fill the register

The 27000 family provides the management system requirements in ISO/IEC 27001, the control catalogue in ISO/IEC 27002, risk in ISO/IEC 27005, measurement in ISO/IEC 27004, sector applications and the vocabulary in ISO/IEC 27000. The introduction places the catalogue in that family. The useful point here is that ISO/IEC 27028 is a member of the same family and expands one feature of ISO/IEC 27002 rather than creating a parallel control set. Buyers who already run 27001 and 27002 do not need a second catalogue; they need to record attribute values for controls they already have. The page links the family, not a vendor's interpretation of it. The family also gives a buyer a way to check an expensive claim. If a supplier says its product 'implements the attribute standard', the question is which document it read and which values it stores, because the family separates the guidance from the certifiable requirements. A short answer is a good sign; a long one usually means the product has a tag field and a marketing page.

The family map stops a team inventing a parallel catalogue. ISO/IEC 27001 holds the requirements, ISO/IEC 27002 the controls and their attributes, ISO/IEC 27005 the risk method and ISO/IEC 27004 the measurement. A buyer who is asked to 'do the attributes' should be able to place the request in that map and see that it touches the control catalogue and the SoA, not the management system requirements. That is a five-minute conversation that prevents a quarter of rework.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method