The publication record
ISO/IEC 27028: stage 60.00, and what happens next
The standard passed its final ballot step and moved to publication on 20 October 2026. ISO says the production steps take up to seven weeks. This page records the stage, the dates, the sources and what a buyer should do before and after publication. It labels every estimate as an estimate.
What the official record says today
- Designation
- ISO/IEC 27028, Edition 1
- Title
- Information security, cybersecurity and privacy protection: Guidance on using information security control attributes
- Committee
- ISO/IEC JTC 1/SC 27, Information security, cybersecurity and privacy protection
- ICS
- 35.030
- Status
- Under publication
- Stage
- 60.00 Under publication, dated 20 October 2026
- Publication window
- up to seven weeks from 20 October 2026, so by 8 December 2026
- Certifiable
- No, guidance
ISO records the document at stage 60.00, under publication, dated 20 October 2026. The same page states that final production steps take up to seven weeks.
Why the date is 8 December 2026, and why that is our date
ISO has announced no publication date. The page states two facts: stage 60.00 is dated 20 October 2026, and final production steps take up to seven weeks. Seven weeks from 20 October 2026 is 8 December 2026. That is our arithmetic from ISO's own sentence, and the site labels it as our arithmetic wherever it appears.
If the record moves to 60.60 the standard is published. If it moves for another reason, the change watch sends the diff. A buyer should not put 8 December in a contract as a deadline; it is a planning date, and the record on this page will change when ISO changes it.
Key date used on the site: 8 December 2026. Basis: This is our arithmetic, not an ISO date. ISO states that final production steps take up to seven weeks from 20 October 2026. Seven weeks from that date is 8 December 2026. ISO has announced no publication date, and the record will change when 60.60 is reached.
What the guidance is, and what it is not
It is
- It is guidance, in the ISO/IEC 27000 family, on using the attributes that ISO/IEC 27002:2022 attaches to its controls.
- It expands the five example attributes (control type, information security properties, cybersecurity concepts, operational capabilities and security domains) and the option to define attributes and attribute values of your own.
- Public commentary on the draft reports two main sections, one on the attribute approach and one on additional attributes, and reports that the draft suggests further attributes beyond the five. The draft body is not public, so this site does not name or list those additional attributes as if they were the standard's.
- It is for any organisation, of any type, size or nature, that uses the ISO/IEC 27002 control catalogue or an equivalent control set.
It is not
- It is not a certifiable management system standard. Certification is against ISO/IEC 27001; guidance does not create a certificate and does not end one.
- It is not a replacement for ISO/IEC 27002:2022. It builds on the attributes in that catalogue rather than restating the controls.
- It does not create a transition deadline. There is no date by which an organisation must adopt the attribute view.
- It is not public in draft. The FDIS text is not available to this site, and no clause of it is quoted or paraphrased here.
The dated stages, as ISO records them
| Stage | Date | What it means |
|---|---|---|
| 10.99 | 3 February 2023 | New project approved |
| 20.00 | 3 February 2023 | New project registered in the work programme |
| 30.00 | 23 January 2024 | Committee draft registered |
| 30.60 | 21 March 2024 | Close of the first comment period |
| 30.92 | 23 May 2024 | Committee draft referred back to the working group |
| 30.99 | 12 November 2024 | Committee draft approved for registration as a DIS |
| 40.20 | 15 January 2025 | First DIS ballot initiated |
| 40.60 | 10 April 2025 | Close of the first DIS ballot |
| 40.93 | 25 November 2025 | Decision for a new DIS ballot |
| 40.20 | 15 December 2025 | Second DIS ballot initiated |
| 40.60 | 10 February 2026 | Close of the second DIS ballot |
| 40.99 | 11 June 2026 | DIS approved for registration as an FDIS |
| 50.00 | 11 June 2026 | Final text received or FDIS registered |
| 50.20 | 24 August 2026 | FDIS ballot initiated, eight weeks |
| 50.60 | 20 October 2026 | Close of voting, proof returned |
| 60.00 | 20 October 2026 | International Standard under publication |
The list is the record's own lifecycle, retrieved 20 October 2026 from the official page. Earlier stages are omitted only where they repeat.
Five things to do before the text lands
Decide
Decide whether to adopt the attribute view this cycle, defer it, or decline it, and record the decision with a reason.
Keep: A one-page decision record with owner and date.
Record
Add the five attribute columns beside the existing Statement of Applicability columns, without changing the inclusion decisions or the justifications.
Keep: A versioned SoA with the new columns, approval recorded.
Compare
Compare your values with the published Table A.1 values and record every deliberate divergence with its reason.
Keep: A divergence column and a note per difference.
Ask
Ask the certification body in writing how it will treat the guidance in the next audit, and record the answer.
Keep: A dated question and answer in the audit file.
Rehearse
Spot-check three controls you know well against the published values and the evidence you hold.
Keep: Three checked controls with a source line and an evidence pointer.
Four things to do when it publishes
Read
Read the published text and check the five attribute definitions and any additional attributes against this record.
Keep: A dated note of any change.
Update
Update the register and the SoA columns if the published text changes a definition or a value list.
Keep: A new register version and a change log row.
Brief
Brief control owners on any change and refresh the internal audit checklist.
Keep: A briefing record and a checklist version.
Watch
Keep the change watch active for corrections, amendments and national adoptions that touch the record.
Keep: The watch email and the record date.
What the guidance adds to ISO/IEC 27002:2022
The catalogue already carries the five attributes. The guidance explains how to use them: how to choose values, how to build a view for an audience, and how to define attributes and attribute values of your own. Public commentary on the draft reports two main sections, one on the attribute approach and one on additional attributes, and reports that the draft suggests further attributes beyond the five. The draft body is not public, so this site does not name or list those additional attributes as the standard's.
For the buyer, the useful change is procedural rather than textual. A team that already records the five values has little to rewrite. A team that records none has a versioned addition to make, an owner to name and a review date to set. That is the work the free check places against your next audit.
Source for this page
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27001:2022, the certifiable requirements. The management system requirements and Annex A, including the Statement of Applicability in clause 6.1.3.
- ISO stage codes. The meaning of the 40, 50 and 60 stage series used in the publication record.
- Public commentary on the draft. A public commentary page, used only to describe the shape of the draft (two main sections and additional attributes). It is not the standard, and no requirement is taken from it.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The change watch, USD 49 a month. An email when the stage, the dates, the record or the guidance changes.