ISO 27001 Annex A 5.25 Assessment And Decision On Information Security Events

Introduction

I am going to show you what ISO 27001:2022 Annex A 5.25 Assessment and Decision on Information Security Events is, what’s new, give you ISO 27001 templates, an ISO 27001 toolkit, show you examples, do a walkthrough and show you how to implement it.

I am Stuart Barker the ISO 27001 Ninja and using over two decades of experience on hundreds of ISO 27001 audits and ISO 27001 certifications I show you exactly what changed in the ISO 27001:2022 update and exactly what you need to do for ISO 27001 certification.

What is ISO 27001 Assessment and Decision on Information Security Events?

ISO 27001:2022 Annex A 5.25 Assessment and decision on information security events is an ISO 27001 control that requires an organisation to assess information security events to categorise and prioritise them.

ISO 27001 Annex A 5.25 Purpose

Annex A 5.25 is a detective control that ensures effective categorisation and prioritisation of information security events.

ISO 27001 Annex A 5.25 Definition

The ISO 27001 standard defines ISO 27001 Annex A 5.25 as:

The organisation should assess information security events and decide if they are to be categorised as information security incidents.

ISO 27001:2022 Annex A 5.25 Assessment and decision on information security events

Implementation Guide

An information security incident is an event that could potentially have a negative impact on the confidentiality, integrity, or availability of information. The consequences of an incident can vary depending on the nature of the incident, the systems and data affected, and the organization’s response.

The priority of an incident is determined by its impact and urgency. Impact refers to how severe the consequences of the incident are, and urgency refers to how quickly action is needed to resolve the incident.

Criteria for Categorising Events as Information Security Incidents

In roles and responsible ISO 27001:2022 Annex A 5.24 Information Security Incident Management Planning And Preparation we assigned the various roles including the contact who will assess each information security incident using the agreed criteria.

The following can be used to categorise events as information security incidents:

• A virus
• Unauthorised access to information systems or data
• Ransomeware
• A system outage
• Social engineering attacks
• Unauthorised disclosure of information
• Unauthorised modification of information
• Denial of service to information systems or users

Assessment of Information Security Events

We also set out in ISO 27001:2022 Annex A 5.24 Information Security Incident Management Planning And Preparation who will co-ordinate and respond to the information security incident and it those people that will perform the assessment and make a decision on the events.

The point of contact should assess each information security event using the following as guidance:

• Impact: The impact of the event should be assessed in terms of the severity of the consequences, such as loss of confidentiality, integrity, or availability of information.
• Urgency: The urgency of the event should be assessed in terms of how quickly a resolution is needed
• Priority: The priority of the event should be determined by its impact and urgency.

Information Security Assessment Formula

Impact x Urgency = Priority

Decision on Information Security Events

The point of contact should make a decision on each information security event based on the assessment. The decision should include the following:

• Whether the event is an information security incident
• The priority of the incident
• The appropriate response to the incident

Recording of Results

The results of the assessment and decision should be recorded. This is for reference, verification, lessons learnt, root cause analysis and continual improvement. We would record the following information:

• The date and time of the event
• The nature of the event
• The impact of the event
• The urgency of the event
• The priority of the event
• The decision on the event
• The response to the event

Implementation Conclusion

This guide provides a framework for identifying the impact, consequences and priority of an information security incident. The guide should be used in conjunction with your information security incident management plan.

The standard that relates to information security management for further reading if required is ISO/IEC 27035

ISO 27001 Templates

You can save months of effort with this ISO 27001 Toolkit that take 25 years of experience and distill it in a pack of prewritten best practice awesomeness. We have included guides on how to respond to incidents and resources to help your implementation.

How to comply

To comply with ISO 27001:2022 Annex A 5.25 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:

1. Identify information security incidents.
2. Assess the impact of information security incidents.
3. Prioritise information security incidents.
4. Respond to information security incidents.
5. Record information security incidents.

How to pass an audit

To pass an audit of ISO 27001:2022 Annex A 5.25 Assessment and decision on information security events you are going to make sure that you have followed the steps above in how to comply.

1. Have a documented information security incident management plan.
2. Implement the information security incident management plan.
3. Monitor the effectiveness of the information security incident management plan.
4. Review and update the information security incident management plan as needed.

You are going to check that it is working by first conducting an internal audit, following the How to Conduct an ISO 27001 Internal Audit Guide.

What will an audit check?

The audit is going to check a number of areas. Lets go through the main ones

1. That you have documented your roles, responsibilities and process

The audit will check the documentation, that you have reviewed it and signed and it off and that it represents what you actually do not what you think they want to hear.

2. That you can demonstrate the process working

They are going to ask you for evidence to the incident management process and take one example. For this example you are going to show them and walk them through the process and prove that you followed it and that the process worked.

3. That you can learn your lesson

Documenting your lessons learnt and following this through to continual improvements or incident and corrective actions will be checked. They want to see that not only did you respond but that you learnt from it and did something to improve that reduced or eliminated the possibility of it happening again.

Top 3 Mistakes People Make

The top 3 Mistakes People Make For ISO 27001:2022 Annex A 5.25 are

1. Not having a documented information security incident management plan.

This is the most common mistake made by organisations. A documented information security incident management plan is essential for effective incident response. It should include the following:

• A process for identifying information security incidents.
• A process for assessing the impact of information security incidents.
• A process for prioritizing information security incidents.
• A process for responding to information security incidents.
• A process for recording information security incidents.

2. Not implementing the information security incident management plan.

Even if you have a documented information security incident management plan, it is not enough to simply have the plan. The plan must be implemented in order to be effective. This means assigning responsibility for implementing the plan, providing training on the plan, and testing the plan.

3. Not monitoring the effectiveness of the information security incident management plan.

Once the information security incident management plan is implemented, it is important to monitor its effectiveness. This means reviewing reports of information security incidents, conducting audits of the plan, and taking corrective action as needed.

By avoiding these mistakes, you can ensure that you have an effective information security incident management plan in place.

Why is ISO 27001 Assessment and Decision on Information Security Events Important?

As the saying goes, shit happens. It is facts of life. No system or security is 100% We cannot be on the back foot when the inevitable happens and effective incident management can eliminate or reduce the impact of information security incidents.

ISO 27001:2022 Annex A 5.25 is important because it provides guidance on how to manage information security incidents. Information security incidents can have a significant impact on an organisation, so it is important to have a plan in place for how to respond to them. The guidance in ISO 27001:2022 Annex A 5.25 can help you to develop and implement an effective information security incident management plan.

The following are some of the benefits of having an effective information security incident management plan:

• It can help to reduce the impact of information security incidents.
• It can help to protect the organisations reputation.
• It can help to comply with legal and regulatory requirements.
• It can help to improve the organisations overall information security posture.

ISO 27001 Assessment and Decision on Information Security Events FAQ

Get the Help of the ISO 27001 Ninja

Book your FREE 30 Minute ISO 27001 Strategy Call and let me show you how you can do it 30x cheaper and 10x faster that you ever thought possible.

Matrix of ISO 27001 controls and ISO 27001 attribute values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Detective	Confidentiality	Respond	Information Security Event Management	Defence
	Integrity	Detect
	Availability