Every organization will face security incidents. What matters is how fast you detect them, how well you respond and what you learn afterwards. Information security incident management gives you a planned, repeatable way to do all three.
In ISO 27001:2013, incident management was Annex A.16, with seven controls. The 2022 edition kept the same ideas in five organizational controls and one people control. This guide explains each step, from preparation to lessons learned.
Free tool: How ready is your organization? Take our ISO 27001 self-assessment: 30 questions on clauses 4–10 and Annex A.
Mapping: A.16 (2013) to ISO 27001:2022
| ISO 27001:2013 | ISO 27001:2022 |
|---|---|
| A.16.1.1 Responsibilities and procedures | 5.24 Information security incident management planning and preparation |
| A.16.1.2 Reporting events, A.16.1.3 Reporting weaknesses | 6.8 Information security event reporting |
| A.16.1.4 Assessment of and decision on events | 5.25 Assessment and decision on information security events |
| A.16.1.5 Response to incidents | 5.26 Response to information security incidents |
| A.16.1.6 Learning from incidents | 5.27 Learning from information security incidents |
| A.16.1.7 Collection of evidence | 5.28 Collection of evidence |
Events vs incidents
First, a key distinction. An event is something that might affect security, such as a failed login or a malware alert. An incident is an event, or a series of events, that actually harms or is likely to harm the business. As a result, most events never become incidents, but you need a process to decide which ones do.
5.24 Planning and preparation
Prepare before anything happens:
- write an incident response plan with roles, contacts and escalation paths;
- define severity levels and response times;
- set up tools for logging, ticketing and secure communication;
- agree on who talks to customers, regulators and the media;
- run tabletop exercises at least once a year.
In India, also include regulatory deadlines. For example, CERT-In directions require organizations to report certain cyber incidents within six hours of noticing them.
6.8 Event reporting
Next, make reporting easy for everyone. Staff, contractors and even suppliers should know how to report a suspicious email, a lost laptop or a strange system behaviour. For instance, provide a “report phishing” button, a short email address and a phone number for urgent cases. Importantly, thank people for reporting, even false alarms, so they keep doing it.
5.25 Assessment and decision
Then triage each event. Decide whether it is an incident, how severe it is and who should handle it. A simple severity table helps:
| Severity | Example | Response |
|---|---|---|
| Critical | Ransomware spreading, confirmed data breach | Immediate, senior management informed |
| High | Compromised admin account | Within hours |
| Medium | Malware on one laptop, contained | Same day |
| Low | Blocked phishing email | Routine handling |
5.26 Response
Respond according to documented procedures. A common sequence is:
- Contain: isolate affected systems and disable compromised accounts.
- Eradicate: remove malware and close the entry point.
- Recover: restore systems from clean backups and monitor closely.
- Communicate: inform stakeholders, customers and regulators as required.
- Close: document actions and confirm the incident is resolved.
5.27 Learning from incidents
After each significant incident, hold a blameless review. Ask what happened, why controls failed and what you will change. Then track the actions to completion, and update risks and procedures. Over time, also look for trends, such as repeated phishing success in one team.
5.28 Collection of evidence
If an incident could lead to legal action or disciplinary steps, collect evidence carefully. Preserve logs, disk images and emails, record who handled them and when, and protect their integrity, for example with hashes. As a result, the evidence stays admissible.
What auditors check
- An incident response plan with current contacts.
- An incident log, with severity, actions and closure dates.
- Evidence of at least one exercise or real incident review.
- Lessons-learned actions and their status.
- Awareness of reporting channels among staff.
For hands-on practice with alerts and triage, see our guide to building a SOC home lab.
Related guides
- ISO 27001:2022 Annex A: all 93 controls and the 2013 mapping
- Free ISO 27001:2022 readiness checklist
- What is an ISMS? Concept, benefits and the PDCA cycle
Sources
- ISO/IEC 27001:2022, Information security management systems (ISO)
- ISO/IEC 27002:2022, Information security controls (ISO)
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. Doing it yourself? The ISO 27001:2022 Starter Kit (₹1,999) gives you the gap workbook, risk register, Statement of Applicability and 13 policy templates. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
