---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
type: control
id: "A.5.26"
title: "Response to information security incidents"
theme: Organizational
control_type: [Corrective]
information_security_properties:
  - Confidentiality
  - Integrity
  - Availability
cybersecurity_concepts:
  - Respond
  - Recover
operational_capabilities: [Information_security_event_management]
security_domains: [Defence]
tags:
- iso27002/2022/EN
- sourcetext
status: active
---

## 5.26 Response to information security incidents

  

### Control
Information security incidents should be responded to in accordance with the documented procedures.

### Purpose
To ensure efficient and effective response to information security incidents.

### Guidance
The organization should establish and communicate procedures on information security incident response to all relevant interested parties.

Information security incidents should be responded to by a designated team with the required competency (see [5.24](a-5.24-Information-security-incident-management-planning-and-preparation.md)).

The response should include the following:

a\) containing, if the consequences of the incident can spread, the systems affected by the incident;
b\) collecting evidence (see [5.28](a-5.28-Collection-of-evidence.md)) as soon as possible after the occurrence;
c\) escalation, as required including crisis management activities and possibly invoking business continuity plans (see [5.29](a-5.29-Information-security-during-disruption.md), [5.30](a-5.30-ICT-readiness-for-business-continuity.md));
d\) ensuring that all involved response activities are properly logged for later analysis;
e\) communicating the existence of the information security incident or any relevant details thereof to all relevant internal and external interested parties following the need-to-know principle;
f\) coordinating with internal and external parties such as authorities, external interest groups and forums, suppliers and clients to improve response effectiveness and help to minimize consequences for other organizations;
g\) once the incident has been successfully addressed, formally closing and recording it;
h\) conducting information security forensic analysis, as required (see [5.28](a-5.28-Collection-of-evidence.md));
i\) performing post-incident analysis to identify root cause. Ensure it is documented and communicated according to defined procedures (see [5.27](a-5.27-Learning-from-information-security-incidents.md));
j\) identifying and managing information security vulnerabilities and weaknesses including those related to controls which have caused, contributed to or failed to prevent the incident.

### Other information
The ISO/IEC 27035 series provides further guidance on incident management.