Control A.5.24Information security incident management planning and preparation
What it means in practice
The organisation must plan and prepare for managing information security incidents by defining, establishing and communicating incident management processes, roles and responsibilities.
The preparation control, and the one that determines whether the three that follow — assessment in A.5.25, response in A.5.26, learning in A.5.27 — have anything to run on.
Planning means deciding in advance: what counts as an incident, who declares one, who leads, who may speak externally, how to reach people out of hours, and how the organisation will communicate when its own systems may be unavailable.
The communicated element is not decoration. A process known only to the security team fails at the first incident detected by somebody else.
For organisations with statutory reporting duties, this is where those timetables have to be built in rather than remembered. A 24-hour early warning obligation is a design constraint on the escalation path, and an escalation path that routinely takes two days to reach a decision-maker cannot meet it.
How to put this in place
Incidents are handled badly when the plan is made during one. Preparing roles, levels and contacts beforehand makes the response fast and consistent.
- Decide the incident roles, severity levels and escalation routes.
- Write the procedure with one reporting route and a named point of contact, linked to the authority contacts in A.5.5.
- Make sure someone can respond out of hours; see also A.5.25 to A.5.27.
- Train the people involved.
- Run a tabletop exercise at planned intervals, for example every 12 months, and record the actions.
Evidence an auditor usually looks for: the procedure, the incident team roster, and exercise records with lessons and actions.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Mandatory ISMS Documentation Checklist
in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists incident management plan: roles, procedures and communication among the documents auditors commonly expect for this control. - Word
Stage 1 and Stage 2 Audit Preparation Guide
in ISO 27001 Implementation & Certification ReadinessListed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge. - Word
Security Incident Management Policy
in Security Incident ManagementIts Framework References list this control. Supported by: Whole policy; roles and responsibilities; IM-03, IM-12. - Word
Incident Response Plan
in Security Incident ManagementIts Framework References list this control. Supported by: Whole plan: phases, roles, deputies, resources, contact directory and calendar. - Excel
Incident Case & Action Log
in Security Incident ManagementIts Framework References list this control. Supported by: The log as the record the incident management process keeps, and the quarterly summary. - Excel
Incident Response Readiness Checklist
in Security Incident ManagementIts Framework References list this control. Supported by: The checklist as a whole: incident management planned and prepared, roles and procedures in place. - Word
Tabletop Exercise Design Methodology
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: The whole method. - Word
Exercise Planning & Facilitation Procedure
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: The whole procedure: planning and testing the incident response. - Excel
Exercise Logistics & Participant Readiness Checklist
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: The checklist as a whole: the exercise that tests incident management is planned and prepared, with roles set. - Word
Personal Data Breach Notification Templates
in Regulatory Incident Notification & ReportingIts Framework References list this control. Supported by: The set prepared and approved before any breach, with the authority's form mapped.