ISO/IEC 27013:2021 6.2.9: Manage major incidents that are also security incidents with informed top management and skilled investigators

What does 6.2.9 require?

A security incident can also be a major incident under ISO/IEC 20000-1 (8.6.1), in which case top management is kept informed. Top management should make sure the investigators of security incidents are appropriately skilled and that the people who collect and analyse evidence have suitable experience. Resolution of a major incident should not have to wait for evidence collection, yet in a case like a compromised payment website evidence is vital, so evidence collection and restoration times should be covered adequately in service requirements and service level agreements.