Information security incident management planning and preparation

What the requirement asks

The organization is to prepare for handling information security incidents by defining, setting up and communicating how incidents are managed and who does what. Purpose: respond to incidents fast, well, in a consistent and orderly way, including how security events are communicated. Guidance on roles: establish the processes and make roles and responsibilities known to relevant internal and external parties, considering a common way to report events with a point of contact (6.8); an incident management process that covers running and documenting incidents, detecting, triaging, prioritizing and analysing them, and communicating and coordinating with interested parties; an incident response process to assess incidents, act on them and learn from them; letting only competent people handle incidents, with documented procedures and regular training; and a process to identify training, certification and ongoing development for responders. Procedures: management agrees incident management objectives, and those responsible understand priorities including resolution times by consequence and severity. Management ensures an incident management plan covering varied scenarios, with procedures for evaluating events against incident criteria; monitoring, detecting, classifying, analysing and reporting events and incidents by people or tools (8.15, 8.16, 5.25, 6.8); managing incidents to closure with response and escalation (5.26) by incident type, possible crisis management and continuity activation, controlled recovery and communication; coordination with authorities, interest groups, suppliers and clients (5.5, 5.6); logging of incident handling; evidence handling (5.28); root cause or post-mortem analysis; and capturing lessons and needed improvements. Reporting procedures cover what to do when an event occurs (note details such as malfunctions and on-screen messages at once, report immediately to the contact point, act only in a coordinated way), incident forms, feedback to reporters on outcomes where possible, and incident reports; external reporting deadlines such as regulatory breach notification must be built in. Other information: incidents can cross organizational and national borders, so coordinating and sharing with outside organizations helps; detailed guidance is in ISO/IEC 27035. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Incident management starts with preparation. The guidance asks for the plan, the roles, the contact routes, the tools and the exercise that proved they work.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep an approved incident management plan and procedures covering evaluation, detection, classification, escalation, recovery, communication, evidence handling and post-incident review and one live sample together.

Evidence an assessor asks for

• Incident management planningAn approved incident management plan and procedures covering evaluation, detection, classification, escalation, recovery, communication, evidence handling and post-incident review
• Incident management planningIncident management objectives and priorities agreed with management, including resolution time frames by severity
• Incident management planningA roles and responsibilities document for the incident team and its communication to internal and external parties
• Incident management planningTraining, certification and exercise records for incident responders
• Incident management planningIncident reporting forms, the point of contact details and records of feedback given to reporters
• Incident management planningA register of external notification obligations and deadlines, such as regulator breach notification

The question an assessor will ask

An assessor will ask for an approved incident management plan and procedures covering evaluation, detection, classification, escalation, recovery, communication, evidence handling and post-incident review, then trace it to the system it protects. For A.5.24 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• The plan exists but has never been exercised against realistic scenarios
• Regulatory notification deadlines are not built into the procedures
• People reporting events never hear the outcome, discouraging future reporting
• Responders lack training or the procedures they are expected to follow

Before the next audit

Before the next audit, check one live sample for this gap: the plan exists but has never been exercised against realistic scenarios.