Sources
The sources behind the record
Every page cites the clause it came from. This is the full list, with the date retrieved and what each source is used for. The ISO/IEC 27028 body is not public and is not among them.
01The list
Sources, retrieved 2026-10-20
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27001:2022, the certifiable requirements. The management system requirements and Annex A, including the Statement of Applicability in clause 6.1.3.
- ISO stage codes. The meaning of the 40, 50 and 60 stage series used in the publication record.
- Public commentary on the draft. A public commentary page, used only to describe the shape of the draft (two main sections and additional attributes). It is not the standard, and no requirement is taken from it.
- ISO/IEC TS 27110, the cybersecurity framework the concepts follow. Referenced by ISO/IEC 27002:2022 clause 4.2 for the five cybersecurity concept values.
02The rule
What is used and what is not
The ISO/IEC 27002:2022 record supplies the control set, the five attribute values, the purpose, the evidence and the gaps. The ISO/IEC 27028 page supplies the stage, the dates, the edition and the abstract. Public commentary is used only to describe the shape of the draft, never as a requirement.
No customer name, no third-party quotation and no statistic is used. Where a page states an interpretation, it says so.