Control A.5.26Response to information security incidents
Information security incidents must be responded to in accordance with the documented procedures.
The execution control. Procedures exist under A.5.24; this requires them to be followed, and it is the point at which planning meets an event that does not match the plan.
Response covers containment, eradication, recovery and the communications that run alongside — internal, to affected parties, and where required to authorities. The record kept during response is what A.5.27’s learning and A.5.28’s evidence both depend on, and it is what nobody has time to write afterwards.
The requirement to respond in accordance with documented procedures is a real constraint, and it cuts both ways. An organisation that improvises has no assurance that anything consistent happened; an organisation whose procedures are too rigid to fit the incident will depart from them and should record why. Deviation recorded is a finding to learn from; deviation unrecorded looks identical to no procedure at all.
How to put this in place
A response that follows a known procedure limits damage and leaves the record needed afterwards. Improvised responses tend to fix symptoms and lose detail.
- Follow the procedure through contain, eradicate, recover and communicate.
- Keep a timeline in the incident record, including for smaller incidents.
- Notify customers, authorities or insurers within the required times.
- Find the cause before closing the incident.
- Have a named person approve closure.
Evidence an auditor usually looks for: incident records with timelines and actions, notifications made and their timing, and closure approvals.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists records of incidents and how they were handled among the documents auditors commonly expect for this control.