Control A.5.24Information security incident management planning and preparation
The organisation must plan and prepare for managing information security incidents by defining, establishing and communicating incident management processes, roles and responsibilities.
The preparation control, and the one that determines whether the three that follow — assessment in A.5.25, response in A.5.26, learning in A.5.27 — have anything to run on.
Planning means deciding in advance: what counts as an incident, who declares one, who leads, who may speak externally, how to reach people out of hours, and how the organisation will communicate when its own systems may be unavailable.
The communicated element is not decoration. A process known only to the security team fails at the first incident detected by somebody else.
For organisations with statutory reporting duties, this is where those timetables have to be built in rather than remembered. A 24-hour early warning obligation is a design constraint on the escalation path, and an escalation path that routinely takes two days to reach a decision-maker cannot meet it.
How to put this in place
Incidents are handled badly when the plan is made during one. Preparing roles, levels and contacts beforehand makes the response fast and consistent.
- Decide the incident roles, severity levels and escalation routes.
- Write the procedure with one reporting route and a named point of contact, linked to the authority contacts in A.5.5.
- Make sure someone can respond out of hours; see also A.5.25 to A.5.27.
- Train the people involved.
- Run a tabletop exercise at planned intervals, for example every 12 months, and record the actions.
Evidence an auditor usually looks for: the procedure, the incident team roster, and exercise records with lessons and actions.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists incident management plan: roles, procedures and communication among the documents auditors commonly expect for this control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.