Annex A (informative) Using attributes

What this part of the catalogue does

Annex A shows how attributes create different views of the controls. A.1 lists the five example attributes and their values and gives Table A.1, a matrix of all 93 controls with the value each takes for the five attributes (control type, security domains, operational capabilities, cybersecurity concepts, information security properties), which can be filtered or sorted in a spreadsheet or database (the per-control values are carried on each control node here). A.2 explains how an organization can define its own attributes, for example linking each control to risk events such as device loss, force majeure, fraud, hacking, disclosure, breach of law or social engineering to speed the comparison of necessary controls with ISO/IEC 27001 Annex A, and suggests others such as maturity, implementation state, priority, organizational area, assets involved, build and run, and frameworks the organization is moving from.

What it means when you fill the register

Annex A is informative. It explains how attributes create views and provides a matrix of all the controls and their values. It suggests that a spreadsheet or database can filter and sort the matrix, and illustrates a view. It does not add requirements. For the buyer this is the practical heart of the record: the published matrix is the baseline against which the organisation's own values can be compared. Our control pages state the published values in our own words and cite the annex, and the kit adds a column for where the organisation's value differs. The comparison is the work, and a divergence with a recorded reason is a stronger answer than a silent copy.

Annex A is the page to put beside the spreadsheet. It gives the matrix of controls and values and shows how a filter produces a view. In practice the comparison with the organisation's own values is the work: copy the published value, add the local value, record the difference and its reason, and keep the source in the row. A divergence is not a defect; an unexplained divergence is. The annex is informative, so the page says that plainly and does not dress the matrix as a requirement.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method