Control A.5.27Learning from information security incidents
What it means in practice
Knowledge gained from information security incidents must be used to strengthen and improve the information security controls.
The control that converts an incident from a cost into information. It requires the organisation to look at what happened, identify what allowed it and what limited it, and change something as a result — controls, procedures, detection, or the risk assessment that did not anticipate it.
The connection to clause 10.2 is direct: the cause analysis that clause requires for a nonconformity is the same discipline applied here to an incident.
Two things distinguish a review that works. It examines the response as well as the attack — how long detection took, whether escalation functioned, whether the communications reached people — and it produces owned actions with dates rather than observations. Reviews that stop at a timeline and a root cause produce a document; reviews that change a control produce the improvement the control exists for.
How to put this in place
An incident that teaches nothing will repeat. This control feeds experience back into risk assessment, training and controls.
- Hold a short blameless review after every significant incident.
- Look at smaller incidents together each quarter.
- Turn the lessons into actions with owners and dates.
- Track the actions to closure.
- Update the risk assessment and training where the lessons call for it.
Evidence an auditor usually looks for: post-incident review records, actions raised and closed, and risk register or training changes that trace back to incidents.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Word
Security Incident Management Policy
in Security Incident ManagementIts Framework References list this control. Supported by: Post-incident review and actions (IM-11). - Word
Incident Response Plan
in Security Incident ManagementIts Framework References list this control. Supported by: Review; the worked example's actions. - Excel
Incident Case & Action Log
in Security Incident ManagementIts Framework References list this control. Supported by: Review due, review held and the Actions sheet: learning from each incident. - Word
Post-Incident Review Template
in Security Incident ManagementIts Framework References list this control. Supported by: Whole form: knowledge from the incident used to strengthen controls. - Word
Tabletop Exercise Design Methodology
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Evaluation scale; findings, actions and re-tests (EX-09 to EX-11). - Word
Exercise Planning & Facilitation Procedure
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Stage 4: findings and actions from the exercise. - Excel
Exercise Observations & Improvement Tracker
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Observations, findings and actions: knowledge gained from exercises used to strengthen incident management. - Word
Exercise After-Action Report Template
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Whole report: knowledge from the exercise used to strengthen the response.