5.24 Information security incident management planning and preparation

The organization is to prepare for handling information security incidents by defining, setting up and communicating how incidents are managed and who does what. Purpose: respond to incidents fast, well, in a consistent and orderly way, including how security events are communicated. Guidance on roles: establish the processes and make roles and responsibilities known to relevant internal and external parties, considering a common way to report events with a point of contact (6.8); an incident management process that covers running and documenting incidents, detecting, triaging, prioritizing and analysing them, and communicating and coordinating with interested parties; an incident response process to assess incidents, act on them and learn from them; letting only competent people handle incidents, with documented procedures and regular training; and a process to identify training, certification and ongoing development for responders. Procedures: management agrees incident management objectives, and those responsible understand priorities including resolution times by consequence and severity. Management ensures an incident management plan covering varied scenarios, with procedures for evaluating events against incident criteria; monitoring, detecting, classifying, analysing and reporting events and incidents by people or tools (8.15, 8.16, 5.25, 6.8); managing incidents to closure with response and escalation (5.26) by incident type, possible crisis management and continuity activation, controlled recovery and communication; coordination with authorities, interest groups, suppliers and clients (5.5, 5.6); logging of incident handling; evidence handling (5.28); root cause or post-mortem analysis; and capturing lessons and needed improvements. Reporting procedures cover what to do when an event occurs (note details such as malfunctions and on-screen messages at once, report immediately to the contact point, act only in a coordinated way), incident forms, feedback to reporters on outcomes where possible, and incident reports; external reporting deadlines such as regulatory breach notification must be built in. Other information: incidents can cross organizational and national borders, so coordinating and sharing with outside organizations helps; detailed guidance is in ISO/IEC 27035.

Source: ISO/IEC 27002:2022, 5.24. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.

ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.