In this guide, I will show you exactly how to implement ISO 27001 Annex A 5.26 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy.
I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience conducting hundreds of audits. I will cut through the jargon to show you exactly what changed in the 2022 update and provide you with plain-English advice to get you certified.
Key Takeaways: ISO 27001 Annex A 5.26 Response to Information Security Incidents
ISO 27001 Annex A 5.26 requires organizations to respond to information security incidents in accordance with documented procedures. While previous controls (A.5.24 and A.5.25) cover the planning and assessment, this control is about the operational execution of your response. It is a corrective control designed to ensure that once an incident is confirmed, your team acts efficiently to contain the threat, recover services, and meet legal obligations (such as the 72-hour GDPR notification rule).
Core requirements for compliance include:
- Documented Response Procedures: You must have clear, step-by-step instructions (often called Playbooks) for different types of incidents, such as ransomware, lost devices, or unauthorized data access.
- Team Competency: The designated response team must have the technical skills and authority to act. This includes the power to take systems offline or disconnect networks during a crisis.
- Containment & Eradication: The immediate goal of the response is to stop the incident from spreading (Containment) and then remove the root cause, such as malware or an exploited vulnerability (Eradication).
- Evidence Collection: During the response, you must collect and preserve evidence (logs, memory dumps, or physical hardware). This is critical if the incident leads to legal action or insurance claims.
- Legal & Regulatory Communication: You must have a process for notifying external parties. For data breaches involving personal data, this often requires notifying a regulator (like the ICO) within a strict legal timeframe.
- Formal Closure: Every incident must be officially “Closed” only after the recovery is complete and a summary report has been created.
Audit Focus: Auditors will look for “The Execution Evidence”:
- Response Timestamps: “Show me the logs for your last major incident. How much time passed between the ‘Decision’ to categorize it (A.5.25) and the start of ‘Containment’?”
- Playbook Accuracy: “Show me your ransomware playbook. Can you prove that the team followed these specific steps during your last malware event?”
- Communication Logs: “If you had a data breach last year, show me the record of your notification to the regulator. Did you meet the mandatory deadline?”
Response Lifecycle Table (Audit Prep):
| Phase | Core Action Required | Primary Goal | ISO 27001:2022 Control |
|---|---|---|---|
| 1. Containment | Isolate infected systems (disconnect). | “Stop the bleeding.” | Annex A 5.26 |
| 2. Eradication | Remove malware / Patch the flaw. | “Clean the wound.” | Annex A 5.26 / 8.8 |
| 3. Recovery | Restore from backup / Restart services. | Get back to work. | Annex A 5.26 / 8.13 |
| 4. Communication | Notify Subjects / Regulators. | Legal Compliance. | Annex A 5.26 / 5.18 |
Table of contents
- What is ISO 27001 Annex A 5.26?
- Watch the ISO 27001 Annex A 5.26 Tutorial
- ISO 27001 Annex A 5.26 Podcast
- ISO 27001 Annex A 5.26 Implementation Guidance
- How to implement ISO 27001 Annex A 5.26
- Response Lifecycle Table
- How to comply
- How to pass an ISO 27001 Annex A 5.26 audit
- What the audit will check
- Top 3 ISO 27001 Annex A 5.26 Mistakes People Make and How to Avoid Them
- Why is ISO 27001 Response to Information Security Incidents Important?
- Applicability of ISO 27001 Annex A 5.26 across different business models.
- Fast Track ISO 27001 Annex A 5.26 Compliance with the ISO 27001 Toolkit
- ISO 27001 Annex A 5.26 FAQ
- Related ISO 27001 Controls
- Further Reading
- ISO 27001 controls and attribute values
What is ISO 27001 Annex A 5.26?
ISO 27001 Annex 5.26 is about your response to information security incidents which means you need a documented process for what you will do.
ISO 27001 Annex A 5.26 Response to information security incidents is an ISO 27001 control that requires an organisation to respond to information security incidents based on documented procedures.
ISO 27001 Annex A 5.26 Purpose
The purpose of ISO 2701 Annex A 5.26 is a corrective control that ensures efficient and effective response to information security incidents.
ISO 27001 Annex A 5.26 Definition
ISO 27001 defines Annex A 5.26 as:
Information security incidents should be responded to in accordance with the documented procedures.
ISO 27001:2022 Annex A 5.26 Response to information security incidents
Watch the ISO 27001 Annex A 5.26 Tutorial
In this tutorial video I show you how to implement ISO 27001 Annex A 5.26 and how to pass the audit.
ISO 27001 Annex A 5.26 Podcast
In this episode: Lead Auditor Stuart Barker and team do a deep dive into the ISO 27001 Annex A 5.26 Response To Information Security Incidents. The podcast explores what it is, why it is important and the path to compliance.
ISO 27001 Annex A 5.26 Implementation Guidance
This guide provides a framework for responding to an information security incident. The guide should be used in conjunction with your information security incident management plan.
The standard that relates to information security management for further reading if required is ISO/IEC 27035
To implement ISO 27001 Annex A 5.26 is straightforward. You are going to document processes and procedures for information security incident response and then communicate to those people that need to know about it.
The team that does the response is going to be designated which means you know and have recorded who they are and they are going to have the required competence to do the job.
What should the incident response process include?
The information security incident response process is going to include
- Containment: stopping the incident from spreading or getting worse
- Evidence Collection: collecting evidence of what happened
- Escalation: considering and acting on escalation as required which may mean invoking business continuity
- Logging: recording the response activities and what you did so you can analyse it later
- Communicating: telling people about the processes so they know what is expected and what to do
- Sharing: sharing knowledge with people that would be interested to improve responsiveness and reduce wider impact
- Closing: once the incident ends formally closing the incident and recording it
- Root cause: identifying why it happened and acting on that root cause conclusion.
The 3 steps of Information Security Incident Response
The 3 steps in information security incident response are:
- Identification: identifying the information security incident
- Assessment: assessing and prioritising the information security incident
- Response: responding to the information security incident incident
How to implement ISO 27001 Annex A 5.26
Implementing ISO 27001 Annex A 5.26 requires a transition from passive monitoring to active containment. Organisations must establish a repeatable framework that ensures security incidents are handled with technical precision to minimise data loss and maintain legal admissibility. By following this action-result focused methodology, you ensure your incident response team operates with the authority and technical depth required by modern certification bodies.
1. Activate the Incident Response Plan (IRP)
Initiate the formalised response procedure immediately upon the validation of a security event. This action ensures that the organisation moves from a state of uncertainty to a structured, pre-approved operational workflow.
- Deploy the Incident Response Team (IRT) based on the specific threat vector identified.
- Assign specific IAM roles to responders to grant temporary, elevated access required for forensic acquisition and containment.
- Review the pre-defined Rules of Engagement (ROE) to ensure all technical actions remain within legal and jurisdictional boundaries.
2. Triage and Categorise Security Events
Conduct an immediate technical assessment to determine the scope, severity, and impact of the incident. This categorisation results in the efficient prioritisation of resources and sets the timeline for regulatory notifications.
- Utilise SIEM and SOC dashboards to map the lateral movement of the threat actor across the network.
- Identify affected data assets and determine if Personal Identifiable Information (PII) is at risk.
- Assign a priority level (Critical, High, Medium, Low) based on the business impact analysis defined in your ISMS.
3. Execute Containment and Eradication Protocols
Isolate affected systems to prevent the spread of malware or unauthorised access. This technical intervention neutralises the active threat while preserving the environment for forensic analysis.
- Implement network segmentation or VLAN isolation to quarantine compromised hosts.
- Revoke compromised credentials and enforce a global MFA reset for high-privilege accounts.
- Remove malicious code, unauthorised backdoors, and persistent threats using clean-room restoration techniques.
4. Facilitate Stakeholder Communication and Notification
Execute the communication plan to inform internal leadership and, where necessary, external regulatory bodies. This action ensures compliance with legal obligations such as the GDPR 72 hour notification window.
- Brief Senior Management on the potential financial and operational risks associated with the breach.
- Coordinate with legal counsel to draft notifications for data subjects and supervisory authorities.
- Provision a dedicated communication channel for the IRT to prevent information leakage during the active response.
5. Restore Systems and Verify Operational Integrity
Return affected services to a trusted state using verified backups and hardened configurations. This result-focused step ensures business continuity without reintroducing the original vulnerability.
- Validate the integrity of backups using SHA-256 cryptographic hashing before restoration.
- Apply emergency patches or configuration changes to close the entry point used by the attacker.
- Monitor restored systems with enhanced logging for a minimum of 48 hours to detect signs of re-infection.
6. Formalise Incident Documentation and Closure
Compile a comprehensive incident report that details every action taken from detection to recovery. This documentation serves as the primary evidence for ISO 27001 auditors and provides the data required for post-incident learning.
- Record a chronological timeline of all technical interventions and decision-making processes.
- Capture all forensic evidence and chain of custody logs in a secure, write-once repository.
- Formally close the incident in the GRC tool only after all immediate corrective actions have been verified.
Response Lifecycle Table
| Phase | Action | Goal |
| 1. Containment | Isolate infected server (disconnect network). | Stop the bleeding. |
| 2. Eradication | Remove malware / Close vulnerability. | Clean the wound. |
| 3. Recovery | Restore from backup / Restart services. | Get back to work. |
| 4. Communication | Notify Data Subject / Regulator (72h rule). | Legal compliance. |
How to comply
To comply with ISO 27001 Annex A 5.26 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:
- Document your information security incident response process
- Assign and document the roles and responsibilities involved in the information response process
- Communicate the incident response processes that those that need to know about it
- Implement appropriate controls to mitigate, monitor and report on information security incidents
- Monitor and review the information security incident response effectiveness
How to pass an ISO 27001 Annex A 5.26 audit
To pass an audit of ISO 27001 Annex A 5.26 Information security incidents should be responded to in accordance with the documented procedures you are going to make sure that you have followed the steps above in how to comply.
- Have a documented information security incident management plan.
- Implement the information security incident management plan.
- Monitor the effectiveness of the information security incident management plan.
- Review and update the information security incident management plan as needed.
What the audit will check
The audit is going to check a number of areas. Lets go through the main ones
1. That you have documented your roles, responsibilities and process
The audit will check the documentation, that you have reviewed it and signed and it off and that it represents what you actually do not what you think they want to hear.
2. That you can demonstrate the process working
They are going to ask you for evidence to the incident response process and take one example. For this example you are going to show them and walk them through the process and prove that you followed it and that the process worked.
3. That you can learn your lesson
Documenting your lessons learnt and following this through to continual improvements or incident and corrective actions will be checked. They want to see that not only did you respond but that you learnt from it and did something to improve that reduced or eliminated the possibility of it happening again.
Top 3 ISO 27001 Annex A 5.26 Mistakes People Make and How to Avoid Them
The top 3 Mistakes People Make For ISO 27001 Annex A 5.26 are
1. Not having a documented information security incident response plan.
This is the most common mistake made by organisations. A documented information security incident response plan is essential for effective incident response. It should include the following:
- A process for identifying information security incidents.
- A process for assessing the impact of information security incidents.
- A process for prioritising information security incidents.
- A process for responding to information security incidents.
- A process for recording information security incidents.
2. Not implementing the information security incident response plan.
Even if you have a documented information security incident response plan, it is not enough to simply have the plan. The plan must be implemented in order to be effective. This means assigning responsibility for implementing the plan, providing training on the plan, and testing the plan.
3. Not monitoring the effectiveness of the information security incident response plan.
Once the information security incident response plan is implemented, it is important to monitor its effectiveness. This means reviewing reports of information security incidents, conducting audits of the plan, and taking corrective action as needed.
By avoiding these mistakes, you can ensure that you have an effective information security incident management plan in place.
Why is ISO 27001 Response to Information Security Incidents Important?
As the saying goes, shit happens. It is facts of life. No system or security is 100% We cannot be on the back foot when the inevitable happens and effective incident management can eliminate or reduce the impact of information security incidents.
ISO 27001 Annex A 5.26 Response to information security incidents is important because it provides guidance on how to manage information security incidents. Information security incidents can have a significant impact on an organisation, so it is important to have a plan in place for how to respond to them. The guidance in ISO 27001 Annex A 5.26 can help you to develop and implement an effective information security incident response plan.
The following are some of the benefits of having an effective information security incident response plan:
- It can help to reduce the impact of information security incidents.
- It can help to protect the organisations reputation.
- It can help to comply with legal and regulatory requirements.
- It can help to improve the organisations overall information security posture.
Applicability of ISO 27001 Annex A 5.26 across different business models.
| Business Type | Applicability | Examples of Control Implementation |
|---|---|---|
| Small Businesses | Highly applicable for ensuring that the team acts effectively during a crisis. The focus is on clear, simple instructions that guide the small staff through containment and recovery without needing a dedicated security department. |
|
| Tech Startups | Critical for startups with complex cloud infrastructures and strict customer SLAs. Compliance involves technical playbooks that automate containment and ensure that “Eradication” doesn’t destroy forensic evidence. |
|
| AI Companies | Vital for protecting unique AI assets and proprietary research data. Focus is on specialized response protocols for adversarial attacks on models or unauthorized exfiltration of large training datasets. |
|
Fast Track ISO 27001 Annex A 5.26 Compliance with the ISO 27001 Toolkit
For ISO 27001 Annex A 5.26 (Response to information security incidents), the requirement is to respond to incidents according to documented procedures. This is a corrective control that ensures your response is efficient and effective, minimising damage through containment, eradication, and recovery.
| Compliance Factor | SaaS Compliance Platforms | High Table ISO 27001 Toolkit | Audit Evidence Example |
|---|---|---|---|
| Strategy Ownership | Rents access to your emergency plans; if you cancel the subscription, your documented response standards and history vanish. | Permanent Assets: Fully editable Word/Excel Incident Response Plans and Lifecycle Tables that you own forever. | A localized “Incident Response Plan” stored on your secure server defining containment steps for a malware outbreak. |
| Response Governance | Attempts to “automate” crisis management via dashboards that cannot physically isolate servers or verify legal reporting windows. | Governance-First: Formalizes your existing technical workflows (Restore, Patch, Notify) into an auditor-ready framework. | A completed “Incident Response Lifecycle Table” proving that containment and recovery were achieved within target timeframes. |
| Cost Efficiency | Charges an “Incident Volume Tax” based on the number of breach logs or active responders, creating perpetual overhead. | One-Off Fee: A single payment covers your response governance for 2 incidents a year or 200. | Allocating budget to advanced forensics tools or SOC services rather than monthly “response” dashboard fees. |
| Crisis Strategy Freedom | Mandates rigid reporting formats that may conflict with your unique technical stack or 72-hour regulatory reporting windows. | 100% Agnostic: Procedures adapt to any environment—dedicated SOCs, lean IT teams, or specialized legal counsel. | The ability to evolve your crisis strategy and notification procedures without reconfiguring a rigid SaaS compliance module. |
Summary: For Annex A 5.26, the auditor wants to see that you have a formal process for responding to incidents and proof that you follow it (e.g., incident logs and evidence of containment). The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.
ISO 27001 Annex A 5.26 FAQ
What is ISO 27001 Annex A 5.26?
ISO 27001 Annex A 5.26 is a reactive security control that mandates organisations establish and implement a formalised procedure for responding to information security incidents.
- Requires a documented Incident Response Plan (IRP).
- Ensures rapid containment, investigation, and recovery.
- Mandates clear communication paths for internal and external stakeholders.
What are the core requirements of an incident response procedure?
To comply with Annex A 5.26, your response procedure must be structured, repeatable, and capable of addressing various threat vectors.
- Definition: Criteria for what constitutes an incident versus an event.
- Containment: Immediate steps to stop the threat from spreading.
- Eradication: Procedures to remove the root cause of the incident.
- Recovery: Safe restoration of affected systems to normal operations.
Does every security incident require a formal response?
Yes, every identified information security incident must be responded to according to your documented procedures, though the scale of the response should be proportional to the risk.
- Triage: Assess the severity and impact of the incident immediately.
- Prioritisation: Focus resources on incidents involving sensitive data or critical infrastructure.
- Consistency: Even minor incidents must follow the formalised logging and closure process.
Who should be involved in the incident response team?
An effective incident response team (IRT) should be a multi-disciplinary group capable of addressing technical, legal, and operational impacts.
- IT/Security Lead: Handles technical containment and forensics.
- Legal/Compliance: Manages regulatory notifications and data breach laws.
- Management: Provides authority for high-impact decisions (e.g., shutting down services).
- Communications/PR: Manages the organisation’s reputation and external messaging.
What is the difference between Annex A 5.26 and 5.24?
Annex A 5.24 focuses on the “planning and preparation” of incident management, while Annex A 5.26 focuses on the actual “execution and response” when an incident occurs.
- 5.24: Strategy, policies, and role definitions.
- 5.26: Active triage, containment, and restoration activities.
- Relationship: 5.26 is the operational implementation of the plans created in 5.24.
How do you evidence Annex A 5.26 for an ISO 27001 audit?
Auditors verify compliance by reviewing documented incident response plans and examining “post-mortem” reports from actual or simulated incidents.
- Incident Logs: Detailed records of when an incident was detected and how it was handled.
- Action Evidence: Proof of containment (e.g., server isolation logs or firewall changes).
- Communication Logs: Records of notifications sent to authorities or affected parties.
Should you use external experts for incident response?
Yes, if your internal team lacks the specialist skills or capacity to handle a major breach, Annex A 5.26 suggests having pre-vetted external forensic and legal specialists on retainer.
- Speed: External specialists provide 24/7 rapid response capabilities.
- Expertise: Deep knowledge of advanced persistent threats (APTs) and malware analysis.
- Objectivity: Independent verification of recovery and security posture.
Related ISO 27001 Controls
ISO 27001 Clause 8.1 Operational Planning and Control
ISO 27001 Annex A 5.25 Assessment And Decision On Information Security Events
ISO 27001 Annex A 5.24 Information Security Incident Management Planning and Preparation
Further Reading
The complete guide to ISO/IEC 27002:2022
The Top 5 Ways AI is Changing ISO 27001
ISO 27001 controls and attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
| Corrective | Confidentiality | Respond | Information Security Event Management | Defence |
| Integrity | Recover | |||
| Availability |
