< Previous standard      ^ Up a level ^      Next standard >

ISO/IEC TS 27028 — Information security, cybersecurity and privacy protection — Guidance on ISO/IEC 27002 attributes [DRAFT]

Abstract

“This document provides guidance on the use and development of attributes aligned to ISO/IEC 27002:2022.”

[Source: ISO/IEC JTC 1/SC 27 SD11 July 2024]

Introduction

ISO/IEC 27002:2022 introduced a new structure for the information security controls, based around ‘themes’ and ‘attributes’. The standard notes that organizations may prefer to use their own attributes as well or instead: ISO/IEC 27028 will explain how to do that, in practice, suggesting a variety of attributes with which to classify or characterise information security controls in various ways for various information security and business management purposes.

Scope of the standard

The standard will expand upon the control attributes in ISO/IEC 27002, providing practical guidance on how to use the attributes and how to develop additional attributes and attribute values where appropriate.

Content of the standard

The standard may cover:

• “Guidance on the development of customized sets of attributes and their usage;
• Attributes can be used to check that an organization's risk treatment plan(s) are tolerant of control failures;
• This concept can be used to confirm that controls cover the different aspects an organization has regarding its risks within scope of an ISMS.”

[Source: design specification]

Status of the standard

Work started on this standard in 2021. It looks likely to be published during 2025.

The standard is at Committee Draft stage, on track and coming along nicely.

It may be a Technical Specification rather thana plain International Standard when released, presumably reflecting the innovative approach (I missed the change notification).

Personal comments

 Generally positive comments on the 1st CD indicate significant interest and support for the standard. I hope it will prove to be a valuable contribution to the field.

A free guideline in the ISO27k Toolkit explains how control attributes can be used creatively within an ISO27k ISMS, or indeed any other information risk-based framework that involves mitigating unacceptable risks using appropriate information security controls. Thinking about which attributes or characteristics of controls are relevant, plus the importance of the corresponding attribute values, helps round-off the analysis and so select appropriate controls.

< Previous standard      ^ Up a level ^      Next standard >