---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
type: control
id: "A.5.27"
title: "Learning from information security incidents"
theme: Organizational
control_type: [Preventive]
information_security_properties:
  - Confidentiality
  - Integrity
  - Availability
cybersecurity_concepts:
  - Identify
  - Protect
operational_capabilities: [Information_security_event_management]
security_domains: [Defence]
tags:
- iso27002/2022/EN
- sourcetext
status: active
---

## 5.27 Learning from information security incidents

### Control
Knowledge gained from information security incidents should be used to strengthen and improve the information security controls.

### Purpose
To reduce the likelihood or consequences of future incidents.

### Guidance
The organization should establish procedures to quantify and monitor the types, volumes and costs of information security incidents.

The information gained from the evaluation of information security incidents should be used to:

a\) enhance the incident management plan including incident scenarios and procedures (see [5.24](a-5.24-Information-security-incident-management-planning-and-preparation.md));

b\) identify recurring or serious incidents and their causes to update the organization’s information security risk assessment and determine and implement necessary additional controls to reduce the likelihood or consequences of future similar incidents. Mechanisms to enable that include collecting, quantifying and monitoring information about incident types, volumes and costs;

c\) enhance user awareness and training (see [6.3](ISO_27002_2022_6.3_OT%20Information%20security%20awareness%2C%20education%20and%20training.md)) by providing examples of what can happen, how to respond to such incidents and how to avoid them in the future.

### Other information

The ISO/IEC 27035 series provides further guidance.