---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
id: "A.4"
title: "Structure of this document"
tags:
- iso27002/2022/EN
- sourcetext
status: active
---
# 4 Structure of this document

## 4.1 Clauses

This document is structured as follows:

a\) Organizational controls (Clause 5)

b\) People controls (Clause 6)

c\) Physical controls (Clause 7)

d\) Technological controls (Clause 8) 

There are 2 informative annexes:

— Annex A— Using attributes
— Annex B— Correspondence with ISO/IEC 27002:2013

Annex A explains how an organization can use attributes (see 4.2) to create its own views based on the control attributes defined in this document or of its own creation.

Annex B shows the correspondence between the controls in this edition of ISO/IEC 27002 and the previous 2013 edition.

## 4.2 Themes and attributes

The categorization of controls given in Clauses 5to 8are referred to as themes.

Controls are categorized as:

a\) people, if they concern individual people;

b\) physical, if they concern physical objects;

c\) technological, if they concern technology;

d\) otherwise they are categorized as organizational.

The organization can use attributes to create different views which are different categorizations of controls as seen from a different perspective to the themes. Attributes can be used to filter, sort or present controls in different views for different audiences. Annex Aexplains how this can be achieved and provides an example of a view.

By way of example, each control in this document has been associated with five attributes with corresponding attribute values (preceded by "#" to make them searchable), as follows:

a\) Control type

Control type is an attribute to view controls from the perspective of when and how the control modifies the risk with regard to the occurrence of an information security incident. Attribute values consist of Preventive (the control that is intended to prevent the occurrence of an information security incident), Detective (the control acts when an information security incident occurs) and Corrective (the control acts after an information security incident occurs).

b\) Information security properties

Information security properties is an attribute to view controls from the perspective of which characteristic of information the control will contribute to preserving. Attribute values consist of Confidentiality, Integrity and Availability.

c\) Cybersecurity concepts

Cybersecurity concepts is an attribute to view controls from the perspective of the association of controls to cybersecurity concepts defined in the cybersecurity framework described in ISO/IEC TS 27110. Attribute values consist of Identify, Protect, Detect, Respond and Recover.

d\) Operational capabilities

Operational capabilities is an attribute to view controls from the practitioner’s perspective of information security capabilities. Attribute values consist of Governance, Asset_management, Information_protection, Human_resource_security, Physical_security, System_and_network\_ security, Application_security, Secure_configuration, Identity_and_access_management,

Threat_and_vulnerability_management, Continuity, Supplier_relationships_security, Legal_and\_ compliance, Information_security_event_management and Information_security_assurance.





e\) Security domains


Security domains is an attribute to view controls from the perspective of four information security 

domains: “Governance and Ecosystem” includes “Information System Security Governance &

Risk Management” and “Ecosystem cybersecurity management” (including internal and external stakeholders); “Protection” includes “IT Security Architecture”, “IT Security Administration”, “Identity and access management”, “IT Security Maintenance” and “Physical and environmental security”; “Defence” includes “Detection” and “Computer Security Incident Management”; “Resilience” includes “Continuity of operations” and “Crisis management”. Attribute values consist of Governance_and_Ecosystem, Protection, Defence and Resilience.

The attributes given in this document are selected because they are considered generic enough to be used by different types of organizations. Organizations can choose to disregard one or more of the attributes given in this document. They can also create attributes of their own (with the corresponding attribute values) to create their own organizational views. Clause A.2includes examples of such attributes.

## 4.3 Control layout

The layout for each control contains the following: 

— **Control title:** Short name of the control;

— **Attribute table**: A table shows the value(s) of each attribute for the given control;

— **Control:** What the control is;

— **Purpose**: Why the control should be implemented; — **Guidance:** How the control should be implemented;

— **Other information:** Explanatory text or references to other related documents.

Subheadings are used in the guidance text for some controls to aid readability where guidance is lengthy and addresses multiple topics. Such headings are not necessarily used in all guidance text. Subheadings are underlined.