This document provides guidance on the use of information security control attributes. The guidance given in this document is generic and is intended to be applicable to all organizations, regardless of type, size, or nature.