Method
How the attribute record is built
One reviewed record drives the pages, the free check and the kit. The control values are exported from the ISO/IEC 27002:2022 record; the requirement, evidence and gap text is our statement in our own words; the publication facts are dated from ISO's own record. This page explains the choices and the limits.
One record, every output
The record is a JSON file with the 93 controls, the 16 structural units, the five attributes and their values, the evidence and gaps, the publication record, the sources and the free-check rules. The pages are rendered from it, the kit is exported from it, and the check reads the same rules. If the record changes, every output changes with it in the same pass.
Each control row carries a source line: the ISO/IEC 27002:2022 clause and the link to the official text, plus the record it was read from. Nothing on a control page is written from a search snippet or from memory.
The attribute record is a view of the controls the organisation already has, not a second catalogue. The control code is the key, and the values describe how the control behaves.
Where the five values come from
The values are the published values from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1, exported control by control. A control can carry more than one value in any attribute; the page shows every value, not a single dominant one. Local values are a separate column in the kit, with a reason for the difference, so a deliberate divergence is visible rather than silent.
The requirement, purpose, evidence and gap text is our statement of the clause in our own words. It is not a quotation, and it is checked for a seven-word overlap with the source before it ships. Only the control titles, defined terms and data element names stay verbatim.
How the free check decides
The check is a deterministic reading of six answers. It adds a score from the answer table, applies two caps (no SoA or no attributes reads Not ready; not sure reads Partly ready), and places three actions against the next audit date. The rule is printed in full under the result, so a reader can disagree with the rule rather than with a black box. A missing or invalid date returns Scope incomplete and names the missing answer. Nothing is assumed and nothing is sent to a server.
The Statement of Applicability justification stays about inclusion and exclusion; the attribute is added beside it. A verdict of Ready now is a statement about the attribute columns and the certification body question. It is not a compliance result, and the page says so beside the verdict.
What the method cannot do
- It cannot state the ISO/IEC 27028 FDIS body: the draft is not public, and no clause is quoted or paraphrased as if it were.
- It cannot decide whether a value is right for your organisation: it can show the published value, the evidence and the reason for a difference.
- It cannot replace the auditor's judgement or the certification body's approach.
- It cannot keep a record current between updates without the change watch or a manual check of the ISO page.