Control A.5.27Learning from information security incidents
Knowledge gained from information security incidents must be used to strengthen and improve the information security controls.
The control that converts an incident from a cost into information. It requires the organisation to look at what happened, identify what allowed it and what limited it, and change something as a result — controls, procedures, detection, or the risk assessment that did not anticipate it.
The connection to clause 10.2 is direct: the cause analysis that clause requires for a nonconformity is the same discipline applied here to an incident.
Two things distinguish a review that works. It examines the response as well as the attack — how long detection took, whether escalation functioned, whether the communications reached people — and it produces owned actions with dates rather than observations. Reviews that stop at a timeline and a root cause produce a document; reviews that change a control produce the improvement the control exists for.
How to put this in place
An incident that teaches nothing will repeat. This control feeds experience back into risk assessment, training and controls.
- Hold a short blameless review after every significant incident.
- Look at smaller incidents together each quarter.
- Turn the lessons into actions with owners and dates.
- Track the actions to closure.
- Update the risk assessment and training where the lessons call for it.
Evidence an auditor usually looks for: post-incident review records, actions raised and closed, and risk register or training changes that trace back to incidents.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.