Control A.5.26Response to information security incidents
What it means in practice
Information security incidents must be responded to in accordance with the documented procedures.
The execution control. Procedures exist under A.5.24; this requires them to be followed, and it is the point at which planning meets an event that does not match the plan.
Response covers containment, eradication, recovery and the communications that run alongside — internal, to affected parties, and where required to authorities. The record kept during response is what A.5.27’s learning and A.5.28’s evidence both depend on, and it is what nobody has time to write afterwards.
The requirement to respond in accordance with documented procedures is a real constraint, and it cuts both ways. An organisation that improvises has no assurance that anything consistent happened; an organisation whose procedures are too rigid to fit the incident will depart from them and should record why. Deviation recorded is a finding to learn from; deviation unrecorded looks identical to no procedure at all.
How to put this in place
A response that follows a known procedure limits damage and leaves the record needed afterwards. Improvised responses tend to fix symptoms and lose detail.
- Follow the procedure through contain, eradicate, recover and communicate.
- Keep a timeline in the incident record, including for smaller incidents.
- Notify customers, authorities or insurers within the required times.
- Find the cause before closing the incident.
- Have a named person approve closure.
Evidence an auditor usually looks for: incident records with timelines and actions, notifications made and their timing, and closure approvals.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Mandatory ISMS Documentation Checklist
in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists records of incidents and how they were handled among the documents auditors commonly expect for this control. - Word
Security Incident Management Policy
in Security Incident ManagementIts Framework References list this control. Supported by: Response, escalation and decisions (IM-05, IM-08, IM-10). - Word
Incident Response Plan
in Security Incident ManagementIts Framework References list this control. Supported by: Contain, eradicate and recover; decision rights. - Excel
Incident Classification, Severity & Escalation Matrix
in Security Incident ManagementIts Framework References list this control. Supported by: Who leads, who is told and how fast, and the playbook each category uses. - Word
Incident Triage & First-Hour Assessment Procedure
in Security Incident ManagementIts Framework References list this control. Supported by: The first hour: containment, escalation and first update. - Word
Ransomware Response Playbook
in Security Incident ManagementIts Framework References list this control. Supported by: First-hour actions, Decision tree, Role actions by phase. - Word
Business Email Compromise Response Playbook
in Security Incident ManagementIts Framework References list this control. Supported by: First-hour actions, Decision tree, Role actions by phase. - Word
Personal Data Breach Response Playbook
in Security Incident ManagementIts Framework References list this control. Supported by: The whole playbook: the response to a personal data breach. - Excel
Incident Case & Action Log
in Security Incident ManagementIts Framework References list this control. Supported by: Cases and Timeline: the response recorded from declaration to closure. - Word
Incident Communications Template Set
in Security Incident ManagementIts Framework References list this control. Supported by: The message set, approvals and approval log: communication as part of the response. - PowerPoint
Tabletop Scenario — Ransomware Encryption of Core Systems
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Whole deck. - PowerPoint
Tabletop Scenario — Insider Data Exfiltration
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Whole deck. - PowerPoint
Tabletop Scenario — Executive Payment Fraud
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Whole deck. - PowerPoint
Tabletop Scenario — Personal Data Breach Against the Clock
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Whole deck. - PowerPoint
Tabletop Scenario — Health Data Breach and the 60-Day Clock
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Whole deck. - PowerPoint
Tabletop Scenario — Is It Material? Four Business Days for a Listed Company
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Whole deck. - Word
Emergency Out-of-Band Patching Procedure
in Patch ManagementIts Framework References list this control. Supported by: When the flaw may already have been used against us: the hand-off to incident response. - Word
Regulatory Notification Operating Procedure
in Regulatory Incident Notification & ReportingIts Framework References list this control. Supported by: The procedure steps NP-01 to NP-09: the response's reporting part.