Control A.5.25Assessment and decision on information security events
Information security events must be assessed and it must be decided whether they are to be categorised as information security incidents.
The triage step, and the distinction it draws is the one that makes the rest workable: an event is something that happened, an incident is an event the organisation has decided warrants a response.
Assessment needs a scheme — criteria and a scale — applied by people with the authority to apply it, and the point is consistency. Where triage depends on who is on shift, the incident record becomes unusable for the trend analysis clause 9.3.2 expects at management review.
Two failure directions, and both are common. Under-categorising keeps numbers down and means the response never starts; over-categorising exhausts the responders so that the real one arrives to a tired team. The corrective is to review the decisions, not only the incidents — periodically sampling events that were not escalated is how an organisation finds out whether its threshold is where it thinks it is.
How to put this in place
Not every event is an incident, but missing a real one is costly. Clear criteria let staff separate noise from incidents quickly and consistently.
- Define what makes an event an incident and the severity levels.
- Set where events are reported and who decides.
- Record each assessment, the decision, who made it and the time.
- Escalate by severity as the procedure says.
- Review the decisions periodically to keep the criteria consistent.
Evidence an auditor usually looks for: the classification criteria and a sample of logged events showing the decision and its timing.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.