ISO 27002:2022 5.27: Learning from information security incidents
What the organization learns from its information security incidents is to be fed back to strengthen and improve its security controls. Purpose: make future incidents less likely or less damaging. Guidance: set up procedures to measure and track the kinds, numbers and costs of incidents. Use what incident evaluation reveals to improve the incident management plan with its scenarios and procedures (5.24); to spot incidents that recur or are serious, and their causes, so the risk assessment is updated and additional controls are chosen and implemented to cut the likelihood or impact of similar events, supported by gathering and tracking data on incident types, volumes and costs; and to enrich user awareness and training (6.3) using real cases that show the possible harm, the right reaction and ways to stop a recurrence. ISO/IEC 27035 carries more on this.
This control maps to 66 controls across 33 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
You are reading one control. How much of ISO 27002:2022 have you already done?
ISO 27002:2022 5.27 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.