ISO/IEC 27035-1:2023

ISO/IEC 27035-1:2023 is the foundation of the ISO/IEC 27035 series: the concepts, principles and process of information security incident management. Clause 4 sets out why events and incidents occur, the objectives (detect and decide on events, assess and respond within a predetermined time frame, minimize impact, escalate to crisis management and back, deal with the vulnerabilities involved, learn quickly, document consistently for metrics), the nine benefits of a structured approach, proportionality to the organization's size, scope, risk and goals, the capability (policies, plan and process; an incident management team under an incident manager and incident response teams under an incident coordinator, with authority, trust and external relationships), communication across phases and organizations, and the documentation set (event report, incident management log, incident report, incident register). Clause 5 gives the five-phase process with its key activities: plan and prepare, detect and report, assess and decide, respond, learn lessons. Annexes relate the series to the investigative standards, give example incidents, cross-reference ISO/IEC 27001 and cover situations discovered during an investigation. Guidance, not certifiable; the process reference behind the incident controls of ISO/IEC 27002 and of most security frameworks.