Assessment and decision on information security events

What the requirement asks

Each information security event is to be assessed and a decision made on whether it counts as an information security incident. Purpose: categorize and prioritize security events effectively. Guidance: an agreed scheme for categorizing and prioritizing incidents should identify an incident's consequences and priority and include the criteria for treating an event as an incident. The point of contact assesses every event against that scheme, and the people responsible for coordinating and responding to incidents carry out the assessment and take the decision. The outcome of each assessment and decision is recorded in enough detail to be referred back to and checked later. ISO/IEC 27035 carries more detail on incident management. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Events need a triage decision. The guidance asks for the criteria, the person who decides, the record of the decision and the route into the incident process.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the agreed incident categorization and prioritization scheme with criteria for declaring an incident and consequence levels and one live sample together.

Evidence an assessor asks for

• Event triageThe agreed incident categorization and prioritization scheme with criteria for declaring an incident and consequence levels
• Event triageTriage records showing each reported event assessed against the scheme
• Event triageDetailed decision records identifying who assessed the event, the categorization and the rationale
• Event triageEvidence that assessors are the designated incident coordination and response personnel
• Event triageMetrics on event volumes, incidents declared and time to decision

The question an assessor will ask

An assessor will ask for the agreed incident categorization and prioritization scheme with criteria for declaring an incident and consequence levels, then trace it to the system it protects. For A.5.25 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• No written criteria for when an event becomes an incident, so decisions are inconsistent
• Events closed as non-incidents without any recorded rationale
• Triage is done by whoever receives the alert rather than designated personnel
• Priority is set by gut feel rather than a consequence-based scheme

Before the next audit

Before the next audit, check one live sample for this gap: no written criteria for when an event becomes an incident, so decisions are inconsistent.