Where the new guidance stands
As of 8 November 2026, ISO lists the first edition of ISO/IEC 27028 as under publication at stage 60.00. It covers the use of information security control attributes and is intended for organisations of any size or type. ISO/IEC 27001:2022, together with its 2024 climate action amendment, remains the current published requirements baseline for an information security management system (ISMS).
What a control attribute does
An attribute is a label that helps teams group controls for a particular purpose. For example, a security manager could group access reviews, logging and incident escalation under identity protection to see how ownership and evidence are spread across teams. The same controls can still appear in their existing risk treatment and audit records.
What your team can do now
- Pilot a small set of labels in your control inventory and test whether they help teams find owners and evidence faster.
- Keep control selection and applicability decisions linked to risk treatment and documented in your Statement of Applicability.
- Check the final ISO/IEC 27028 publication before adopting its guidance across your ISMS.
For the role of guidance and requirements across the standards family, see Hallbar’s ISO/IEC 27000 overview.