---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
type: control
id: "A.5.25"
title: "Assessment and decision on information security events"
theme: Organizational
control_type: [Detective]
information_security_properties:
  - Confidentiality
  - Integrity
  - Availability
cybersecurity_concepts:
  - Detect
  - Respond
operational_capabilities: [Information_security_event_management]
security_domains: [Defence]
tags:
- iso27002/2022/EN
- sourcetext
status: active
---

## 5.25 Assessment and decision on information security events

  

### Control
The organization should assess information security events and decide if they are to be categorized as information security incidents.

  

### Purpose

  

To ensure effective categorization and prioritization of information security events.

  

### Guidance

  

A categorization and prioritization scheme of information security incidents should be agreed for the identification of the consequences and priority of an incident. The scheme should include the criteria to categorize events as information security incidents. The point of contact should assess each information security event using the agreed scheme.

Personnel responsible for coordinating and responding to information security incidents should perform the assessment and make a decision on information security events.

Results of the assessment and decision should be recorded in detail for the purpose of future reference and verification.

### Other information
The ISO/IEC 27035 series provides further guidance on incident management.