Themes and attributes

What this part of the catalogue does

Clause 4.2 explains the four themes (a control concerning individual people is a people control, physical objects a physical control, technology a technological control, anything else organizational) and the five example attributes, each value prefixed with a hash sign so it can be searched: control type (preventive, detective, corrective, by when the control acts relative to an incident), information security properties (which of confidentiality, integrity and availability the control serves), cybersecurity concepts taken from ISO/IEC TS 27110 (the five functions identify, protect, detect, respond and recover), then operational capabilities (fifteen practitioner capability areas from governance to information security assurance) and security domains (four areas: protection, defence, resilience, and governance with the wider ecosystem). Organizations may ignore attributes or define their own to filter, sort and present controls for different audiences.

What it means when you fill the register

This is the clause the guidance expands. It defines the four themes, then defines five attributes: control type, information security properties, cybersecurity concepts, operational capabilities and security domains. It explains that attributes are a different categorisation from the themes, and that a team can sort them, filter them or put a selected view in front of a particular audience. Each value is written with a leading hash so it can be searched, and each control carries a set of values. It also states that an organisation may define attributes of its own as well as, or instead of, the five examples. For the buyer this is the permission slip and the constraint: the five are examples, not a closed list, and a local attribute is legitimate when it is defined and recorded.

This is the clause to read before buying a tool. It sets out the five examples, the hashtag convention, the permission to define your own attributes, and the idea of a view for a particular audience. A tool that supports five fixed tags but not a defined local attribute has implemented part of the clause. A register that records the published values and a local value, with a reason for the difference, has implemented the useful part. The distinction is worth putting in the requirements list.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method