The ultimate how to implement guide to ISO 27001 Annex A 5.24 Information Security Incident Management Planning and Preparation.
Table of contents
- 1. Draft a Physical Information Security Incident Management Policy
- 2. Form an Internal Incident Response Team (IRT)
- 3. Define Manual Incident Classification and Escalation Criteria
- 4. Establish Out-of-Band Communication Channels
- 5. Configure Local Forensic Logging Baselines
- 6. Create Technical ‘Playbooks’ for Common Attack Vectors
- 7. Secure a Forensic Evidence Kit
- 8. Conduct a Manual Tabletop Simulation
- 9. Formalise External Reporting Obligations
- 10. Implement a Post-Incident Review (PIR) Process
1. Draft a Physical Information Security Incident Management Policy
Control Requirement: Establish a documented policy and supporting procedures for managing information security incidents.
Required Implementation Step: Open your local document editor and draft a specific policy that defines what constitutes an ‘incident’ versus an ‘event’. Print a physical copy and place it in an ‘Emergency Response’ binder that is accessible even if your primary network is encrypted by ransomware.
Minimum Requirement: A version-controlled policy document signed by the CISO and stored in a secure, offline location.
2. Form an Internal Incident Response Team (IRT)
Control Requirement: Assign specific roles and responsibilities for incident management activities.
Required Implementation Step: Do not just list ‘IT’ as the owner. Manually assign specific individuals from IT, Legal, HR, and Communications to the team; document their direct office phone numbers and home contact details in a private, encrypted file.
Minimum Requirement: A formal ‘Contact Matrix’ identifying the Lead Incident Handler and secondary deputies.
3. Define Manual Incident Classification and Escalation Criteria
Control Requirement: Establish criteria for prioritising and escalating incidents based on impact and urgency.
Required Implementation Step: Create a physical 3×3 matrix mapping business impact against urgency. Manually define the ‘Red Alert’ triggers that require immediate board-level notification, bypassing the ticket-queue mentality of most GRC tools.
Minimum Requirement: A documented classification table that allows any staff member to identify a ‘Critical’ incident in under 60 seconds.
DO IT YOURSELF
ISO 27001
All the templates, tools, support and knowledge you need to do it yourself.
4. Establish Out-of-Band Communication Channels
Control Requirement: Ensure communication mechanisms are in place to report and manage incidents when primary systems fail.
Required Implementation Step: Set up a dedicated communication channel (e.g., a physical phone tree or a hardened, independent messaging app) that does not rely on the corporate Active Directory or Office 365 environment.
Minimum Requirement: A tested communication plan that functions during a total primary network outage.
5. Configure Local Forensic Logging Baselines
Control Requirement: Ensure that sufficient logging and monitoring are in place to detect and investigate incidents.
Required Implementation Step: Log into your core switches and servers to manually verify that NTP (Network Time Protocol) is synchronised across all devices. Ensure logs are being piped to a local, immutable ‘Write Once Read Many’ (WORM) storage device that is physically separate from the production environment.
Minimum Requirement: Synchronised timestamps across 100% of critical infrastructure logs.
6. Create Technical ‘Playbooks’ for Common Attack Vectors
Control Requirement: Develop procedures to respond to specific types of security incidents.
Required Implementation Step: Write manual ‘Playbooks’ for Ransomware, DDoS, and Phishing. These must include the specific command-line strings needed to isolate a VLAN or revoke an OAuth token—information a GRC platform cannot provide during a live breach.
Minimum Requirement: Three technical playbooks detailing manual isolation and containment steps.
7. Secure a Forensic Evidence Kit
Control Requirement: Establish procedures for the identification, collection, acquisition, and preservation of digital evidence.
Required Implementation Step: Purchase and store a physical ‘Forensic Kit’ containing write-blockers, sterile USB drives, and evidence bags. Document the manual process for maintaining a ‘Chain of Custody’ for any hardware seized during an investigation.
Minimum Requirement: A physical evidence kit and a printed Chain of Custody template.
8. Conduct a Manual Tabletop Simulation
Control Requirement: Regularly test the incident management plan through exercises and simulations.
Required Implementation Step: Gather the IRT in a physical room and run a ‘silent’ tabletop exercise where you simulate a total server room fire or data breach. Manually record the team’s actions and failures on a whiteboard, then update your procedures based on these real-world observations.
Minimum Requirement: An ‘After-Action Report’ (AAR) from a simulated exercise conducted within the last 12 months.
9. Formalise External Reporting Obligations
Control Requirement: Define procedures for reporting incidents to external authorities and stakeholders.
Required Implementation Step: Manually research and document the specific reporting portals and deadlines for the ICO (UK) or relevant regulatory bodies. Draft ‘Pro-Forma’ notification letters that can be filled in manually to save time during the first 72 hours of a breach.
Minimum Requirement: A list of external regulatory contacts and pre-drafted notification templates.
10. Implement a Post-Incident Review (PIR) Process
Control Requirement: Use lessons learned from past incidents to improve the incident management plan.
Required Implementation Step: Create a mandatory ‘Closed-Loop’ procedure where every ‘Medium’ or ‘High’ incident requires a physical meeting to document root causes. Update the ‘config files’ or ‘physical security’ controls manually following the meeting to ensure the vulnerability is closed.
Minimum Requirement: A signed PIR document for the most recent security incident or exercise.
About the author
