Clauses

What this part of the catalogue does

Clause 4.1 sets out the structure: organizational controls in Clause 5, people controls in Clause 6, physical controls in Clause 7 and technological controls in Clause 8, followed by two informative annexes, Annex A on using attributes to build views of the controls and Annex B mapping this edition to the 2013 edition.

What it means when you fill the register

The structure clause explains that the document is organised into four control themes (organisational, people, physical and technological) and two informative annexes, one on using attributes and one on the correspondence with the previous edition. The themes are the primary grouping; the attributes cut across them. For the register the theme is a column and a filter, not a hierarchy to be rebuilt. A control belongs to one theme and carries several attribute values at once. That is the whole design: one control, one theme, several views. A buyer who rebuilds the catalogue around the attributes loses the theme, and with it the link to the annex of ISO/IEC 27001, which is the reference most auditors will use. The theme column also makes a migration easier. A team moving from the earlier edition can sort by theme, find the old codes in the reference column, and check the values beside them. The structure clause is short, but it is the reason that sort works at all, and it is worth keeping in the register rather than assuming every reader knows the four theme names.

The four themes are the auditor's index: organisational, people, physical and technological. Most audit plans are organised that way, and most SoAs are too. The attribute view sits across the index rather than replacing it. In practice this means the register should keep the theme column first, then the control code and name, then the five attributes. A reader who wants the audit plan's order gets it; a reader who wants the board's view filters the same rows.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method