Response to information security incidents

What the requirement asks

Incidents are to be handled following the documented response procedures. Purpose: respond to information security incidents efficiently and effectively. Guidance: set and communicate response procedures to relevant parties, and have a designated, competent team respond (5.24). Response includes: containing affected systems where consequences could spread; collecting evidence as early as possible (5.28); escalating as needed, including crisis management and possibly business continuity plans (5.29, 5.30); logging all response activity for later analysis; informing relevant internal and external parties of the incident or relevant details on a need-to-know basis; working with authorities, specialist groups, suppliers and clients to respond better and limit harm to others; formally closing and recording the incident once resolved; carrying out forensic analysis where required (5.28); analysing afterwards to find the root cause and documenting and communicating it as defined (5.27); and identifying and managing vulnerabilities and weaknesses, including control weaknesses that caused, contributed to or failed to stop the incident. More on incident handling is in ISO/IEC 27035. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Response is expected to follow the plan and to be recorded. The guidance asks for the timeline, the actions, the decisions, the communication and the containment evidence.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep documented incident response procedures or playbooks communicated to relevant parties and one live sample together.

Evidence an assessor asks for

• Incident responseDocumented incident response procedures or playbooks communicated to relevant parties
• Incident responseIncident records showing containment, evidence collection, escalation, communication and formal closure
• Incident responseResponse activity logs or ticket histories kept for later analysis
• Incident responseCommunication records to internal and external parties following need-to-know
• Incident responseRoot cause analysis reports and the resulting vulnerability or control weakness remediation actions
• Incident responseRecords of coordination with authorities, suppliers or clients during significant incidents

The question an assessor will ask

An assessor will ask for documented incident response procedures or playbooks communicated to relevant parties, then trace it to the system it protects. For A.5.26 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Containment is delayed while approval is sought, letting the incident spread
• Incidents are closed without root cause analysis
• Response actions are not logged, so later analysis and evidence are weak
• Control weaknesses revealed by the incident are never tracked to remediation

Before the next audit

Before the next audit, check one live sample for this gap: containment is delayed while approval is sought, letting the incident spread.