ISO 27001 Annex A 5.24 Information Security Incident Management Planning and Preparation

ISO 27001 Information Security Incident Management Planning and Preparation

In this ultimate guide to ISO 27001 Annex A 5.24 Information Security Incident Management Planning and Preparation you will learn

• What is ISO 27001 Annex A 5.24
• How to implement ISO 27001 Annex A 5.24

I am Stuart Barker, the ISO 27001 Ninja and author of the Ultimate ISO 27001 Toolkit.

With over 30 years industry experience I will show you what’s new, give you ISO 27001 templates, show you examples, do a walkthrough and show you how to implement it for ISO 27001 certification.

What is ISO 27001 Annex A 5.24 ?

ISO 27001 Annex A 5.24 Information security incident management planning and preparation is an ISO 27001 Annex A control that requires an organisation to plan and prepare for managing information security incidents.

Purpose

The purpose of ISO 27001 Annex A 5.24 is a corrective control that ensures quick, effective, consistent and orderly response to information security incidents, including communication on information security events.

Definition

The ISO 27001 standard defines ISO 27001 Annex A 5.24 as:

The organization should plan and prepare for managing information security incidents by defining, establishing and communicating information security incident management processes, roles and responsibilities.

ISO 27001:2022 Annex A 5.24 Information security incident management planning and preparation

Implementation Guide

Roles and Responsibilities

You are going to work out the roles and responsibilities for the incident management processes and procedures that you are going to write and implement. Those roles and responsibilities are going to be communicated.

Usually you communicate reasonably frequently, say once every 3 months, how to raise an incident and who is responsible for information security in the organisation. Depending how complex the team is and how complex the organisation is you may have to do some additional targeted communications.

Ideally we want a common way to report information security incidents and have a point of contact.

The process of incident management is well documented elsewhere but the process is going to be cover documentation, how we detect incidents, how we prioritise them, if relevant how we triage the incidents, how we analyse incidents, how and to whom we communicate them and how we co-ordinate interested parties.

The standard wants us, rightly, to provide the capability to assess, respond and learn from security incidents. We won’t get things right all the time. Incidents will happen. As long as we plan and are prepared and can respond effectively we will be fine.

When it comes to the who, we are going to make sure that only competent personnel handle issues. Usually this means that they are subject matter experts and or trained in their field. These people will be communicated to and provided the process and procedure documents and will be given periodic training in information security.

As an add in, the standard wants us to consider identifying the training, certification and ongoing development of the incident response assigned people. A great way to do this is via the competency matrix.

Incident Management Procedures

The incident management processes and procedures you write will have priorities and service level’s agreed with management based on agreed objectives for information security incident management. Consider implementing priority levels with definitions of what each priority means and the expected time to resolve an incident at that level.

The incident management plan will consider different scenarios.

If we were to set out the activities that require process and procedure we would include

Evaluation

The evaluation of incidents and understanding which incidents are information security incidents.

Monitoring

The human and automated ability to detect, classify, analyse and report events and incidents.

Managing

The management of incidents that includes response and escalation and knowing when to invoke crisis management and business continuity.

Coordinating

The coordination of internal and external interested parties and resources

Logging

The logging of incidents and associated activity.

Handling of evidence

The handling of evidence and the potential to get specialist help where that evidence may lead to legal action.

Root Cause Analysis

The ability to get to the root, the core, of what happened and why it happened.

Lessons Learned

The ability to learn lessons and make improvements to reduce or eliminate it from happening again.

Reporting Procedures

We need to ability to effectively report on incidents and consider the types of reports that we will create.

We include how to report an incident, the use of incident forms and the creating of incident reports.

External reporting requirements and time frames are considered. A good example is reporting data breaches that come under the GDPR to the supervisory body.

The standard that relates to information security management for further reading if required is ISO/IEC 27035

ISO 27001 Templates

You can save months of effort with these ISO 27001 templates that take 25 years of experience and distill it in a pack of prewritten best practice awesomeness. The ISO 27001 Toolkit is designed to fast track your ISO 27001 certification.

How to comply

To comply with ISO 27001 Annex A 5.24 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:

• Define and allocate roles and responsibilities
• Write and implement your incident management processes and procedures
• Communicate incident management to interested parties

How to pass an audit

To pass an audit of ISO 27001 Annex A 5.24 Information security incident management planning and preparation you are going to make sure that you have followed the steps above in how to comply.

What an auditor will check

The audit is going to check a number of areas. Lets go through the main ones

1. That you have documented your roles, responsibilities and process

The audit will check the documentation, that you have reviewed it and signed and it off and that it represents what you actually do not what you think they want to hear.

2. That you can demonstrate the process working

They are going to ask you for evidence to the incident management process and take one example. For this example you are going to show them and walk them through the process and prove that you followed it and that the process worked.

3. That you can learn your lesson

Documenting your lessons learnt and following this through to continual improvements or incident and corrective actions will be checked. They want to see that not only did you respond but that you learnt from it and did something to improve that reduced or eliminated the possibility of it happening again.

Top 3 Mistakes People Make

The top 3 Mistakes People Make For ISO 27001 Annex A 5.24 are

1. You didn’t learn your lesson

Not learning and improving is a big mistake. Having your documentation to evidence that you made a corrective action or continual improvement will be key.

2. You didn’t tell people how to raise and incident

The auditor will likely ask everyone they meet, not just you, how to raise an incident. This is bread and butter stuff for them. Everyone being audited as a minimum should know how to raise an incident.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

FAQ

ISO 27001 controls and attribute values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Corrective	Confidentiality	Respond	Governance	Defence
	Integrity	Recover	Information Security Event Management
	Availability