ISO 27002:2022
Organizational controls – ISO 27002:2022

ISO 27002:2022 5.25: Assessment and decision on information security events

Each information security event is to be assessed and a decision made on whether it counts as an information security incident. Purpose: categorize and prioritize security events effectively. Guidance: an agreed scheme for categorizing and prioritizing incidents should identify an incident's consequences and priority and include the criteria for treating an event as an incident. The point of contact assesses every event against that scheme, and the people responsible for coordinating and responding to incidents carry out the assessment and take the decision. The outcome of each assessment and decision is recorded in enough detail to be referred back to and checked later. ISO/IEC 27035 carries more detail on incident management.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 92 controls across 34 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 9 controls

  • AU-5 Response to Audit Logging Process Failures
  • AU-6 Audit Record Review, Analysis, and Reporting
  • IR-1 Policy and Procedures
  • IR-4 Incident Handling
  • IR-5 Incident Monitoring
  • SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16))
  • SI-4(2) Automated Tools and Mechanisms for Real-Time Analysis
  • SI-4(4) Inbound and Outbound Communications Traffic
  • SR-10 Inspection of Systems or Components (SR-10)

FedRAMP Moderate · 9 controls

  • AU-5 Response to Audit Logging Process Failures
  • AU-6 Audit Record Review, Analysis, and Reporting
  • IR-1 Policy and Procedures
  • IR-4 Incident Handling
  • IR-5 Incident Monitoring
  • SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16))
  • SI-4(2) Automated Tools and Mechanisms for Real-Time Analysis
  • SI-4(4) Inbound and Outbound Communications Traffic
  • SR-10 Inspection of Systems or Components (SR-10)

CIS Controls v8 · 7 controls

  • CIS-13.1 Centralize Security Event Alerting
  • CIS-13.11 Tune Security Event Alerting Thresholds
  • CIS-13.3 Deploy a Network Intrusion Detection Solution
  • CIS-17.1 Designate Personnel to Manage Incident Handling
  • CIS-17.3 Establish and Maintain an Enterprise Process for Reporting Incidents
  • CIS-17.4 Establish and Maintain an Incident Response Process
  • CIS-17.9 Establish and Maintain Security Incident Thresholds

NIST Cybersecurity Framework 2.0 · 7 controls

NIST SP 800-53 Rev 5 · 7 controls

ACSC Essential Eight · 5 controls

  • E8-APP-ML2 Application Control (ML2)
  • E8-ADMIN-ISM-1228 Restrict administrative privileges (ISM-1228): Cyber security events are analysed in a timely manner to identify cyber security incidents
  • E8-APP-ISM-1228 Application control (ISM-1228): Cyber security events are analysed in a timely manner to identify cyber security incidents
  • E8-MFA-ISM-1228 Multi-factor authentication (ISM-1228): Cyber security events are analysed in a timely manner to identify cyber security incidents
  • E8-UAH-ISM-1228 User application hardening (ISM-1228): Cyber security events are analysed in a timely manner to identify cyber security incidents

SOC 2 · 5 controls

  • SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
  • SOC2-CC7.2 CC7.2 Monitoring system components for anomalies
  • SOC2-CC7.3 CC7.3 Evaluating security events to identify incidents
  • SOC2-CC7.4 CC7.4 Responding to security incidents
  • SOC2-CC7.5 CC7.5 Recovering from security incidents

Azure Security Benchmark · 3 controls

  • ASBv3-IR-2 Preparation - setup incident notification
  • ASBv3-IR-3 Detection and analysis - create incidents based on high-quality alerts
  • ASBv3-IR-5 Detection and analysis - prioritize incidents

DORA · 3 controls

ISO 27701:2019 · 3 controls

  • 5.8.1 Nonconformity and corrective action
  • 6.13 Information security incident management
  • 6.13.1 Management of information security incidents and improvements

PCI DSS 4.0 · 3 controls

  • 10.4.3 10.4.3 Exceptions and anomalies from log review addressed
  • 12.10.5 12.10.5 Plan covers alerts from security monitoring systems
  • 12.10.7 12.10.7 Response procedures for PAN found in unexpected locations

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-28 Continuous incident detection and response (Excellent)
  • ASD37-31 Hunt to discover incidents (Very Good)

AWS Well-Architected Security Pillar · 2 controls

  • SEC04-BP03 Correlate and enrich security alerts
  • SEC10-BP04 Develop and test security incident response playbooks

C5 (Germany) · 2 controls

  • C5-OPS-13 Logging and Monitoring - Identification of Events
  • C5-SIM-02 Processing of security incidents

CMMC 2.0 · 2 controls

HIPAA Security Rule · 2 controls

NIS2 Directive · 2 controls

  • Art.21.2.b Incident handling
  • Art.23.1 Notify significant incidents to the CSIRT or competent authority, and warn affected service recipients

NIST SP 800-171 Rev 3 · 2 controls

  • 03.06.01 Incident Handling
  • 03.06.02 Incident Monitoring, Reporting, and Response Assistance

NIST SP 800-66 Rev 2 · 2 controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-40 Define a Security Incident Management Procedure

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-27 Identification and Escalation of Incidents and Near Misses

APRA CPS 234 · 1 control

  • CPS234-30 Detection and Response Mechanisms

Australia Consumer Data Right - Banking (CDR) · 1 control

Australia My Health Records Act 2012 · 1 control

Australian Information Security Manual · 1 control

  • ISM-1228 Analysing cyber security events for incidents

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-16 Security Incident Response Plan and Testing

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

GDPR · 1 control

  • GDPR-Art.33 Notification of a personal data breach to the supervisory authority

ISO 22301:2019 · 1 control

  • 10.2 Continual improvement

ISO 27001:2022 · 1 control

  • 5.25 Assessment and decision on information security events

ISO 27018:2019 · 1 control

  • 16.1.4 Assessment of and decision on information security events

ISO/IEC 42001:2023 · 1 control

  • 10.2 Nonconformity and corrective action

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-172 · 1 control

  • 3.6.1e Establish Security Operations Center (SOC)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Organizational controls – ISO 27002:2022

You are reading one control. How much of ISO 27002:2022 have you already done?

ISO 27002:2022 5.25 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.

If you hold NIST SP 800-53 Rev 584.9% covered · 14 gapsIf you hold FedRAMP Moderate80.6% covered · 18 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.174.2% covered · 24 gapsIf you hold C5 (Germany)69.9% covered · 28 gapsIf you hold NIST Cybersecurity Framework 2.063.4% covered · 34 gapsIf you hold NIST SP 800-171 Rev 357% covered · 40 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 92 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO 27002:2022 controls