ISO/IEC 27028 · stage 60.00 Under publication 20 October 2026 Publication window by 8 Dec 2026, our arithmetic Official record
27028ISO 27028 Revision CheckerGuidance, recorded before publication

Clauses and annexes

ISO/IEC 27002:2022, 2

Normative references

The structural clause 2, with what it does in the catalogue, why it matters to the attribute record and what a buyer should keep. This page is our statement of the clause, not the text.

01The clause

What this part of the catalogue does

Clause 2 records that the document has no normative references.

02The practice

What it means when you fill the register

The clause states that there are no normative references. The absence matters in practice: nothing else is incorporated by reference, so the definitions and the control set stand on their own, and the reader is not sent to another document to complete a requirement. For an attribute register the implication is that the values are the ones defined in this document, and a value borrowed from a different framework should be labelled as the organisation's own, not as this standard's. That distinction is the one most often lost when a tool offers a generic tag list. The register can hold both, as long as the source column says which is which. Our kit keeps a published value and a local value in separate columns for that reason. There is a second practical consequence. A template that cites an external definition should be checked before it is used in a client pack, because the reader will assume the definition is authoritative. Where the definition is ours, the site says so. Where it is the standard's, the citation is to the clause. The reader should never have to guess which kind of statement they are reading.

No normative references means no hidden dependency. In practice this is a useful test of a tool or a template: if it tells you an attribute definition comes from somewhere else, ask which document, and check whether that document is in the family. A value borrowed from a different framework can be useful, but it should be labelled as the organisation's own rather than presented as the published value. The register keeps both columns so the reader can see the difference without a footnote.

03What to record

What to keep beside the register

  • The clause reference and the edition you read, so a later reader can check it.
  • The decision it supports, with an owner and a date.
  • The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

04Read next
05Source

Source for this page

Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.