#iso27002/2022/EN
## 5.24 Information security incident management planning and preparation

#### Control
The organization should plan and prepare for managing information security incidents by defining, establishing and communicating information security incident management processes, roles and responsibilities.

#### Purpose
To ensure quick, effective, consistent and orderly response to information security incidents, including communication on information security events.

#### Guidance

**Roles and responsibilities**

The organization should establish appropriate information security incident management processes. Roles and responsibilities to carry out the incident management procedures should be determined and effectively communicated to the relevant internal and external interested parties.

The following should be considered:

a\) establishing a common method for reporting information security events including point of contact (see [6.8](ISO_27002_2022_6.8_OT%20Information%20security%20event%20reporting.md));

b\) establishing an incident management process to provide the organization with capability for managing information security incidents including administration, documentation, detection, triage, prioritization, analysis, communication and coordinating interested parties;

c\) establishing an incident response process to provide the organization with capability for assessing, responding to and learning from information security incidents;

d\) only allowing competent personnel to handle the issues related to information security incidents within the organization. Such personnel should be provided with procedure documentation and periodic training;

e\) establishing a process to identify required training, certification and ongoing professional development for incident response personnel.

**Incident management procedures**

The objectives for information security incident management should be agreed with management and it should be ensured that those responsible for information security incident management understand the organization’s priorities for handling information security incidents, including resolution time frame based on potential consequences and severity. Incident management procedures should be implemented to meet these objectives and priorities.

Management should ensure that an information security incident management plan is created considering different scenarios and procedures are developed and implemented for the following activities:

a\) evaluation of information security events according to criteria for what constitutes an information security incident;

b\) monitoring (see [8.15](ISO_27002_2022_8.15_OT%20Logging.md) and [8.16](ISO_27002_2022_8.16_OT%20Monitoring%20activities.md)), detecting (see [8.16](ISO_27002_2022_8.16_OT%20Monitoring%20activities.md)), classifying (see [5.25](ISO_27002_2022_5.25_OT%20Assessment%20and%20decision%20on%20information%20security%20events.md)), analysing and reporting (see [6.8](ISO_27002_2022_6.8_OT%20Information%20security%20event%20reporting.md)) of information security events and incidents (by human or automatic means);
 
c\) managing information security incidents to conclusion, including response and escalation (see [5.26](ISO_27002_2022_5.26_OT%20Response%20to%20information%20security%20incidents.md)), according to the type and the category of the incident, possible activation of crisis management and activation of continuity plans, controlled recovery from an incident and communication to internal and external interested parties;

d\) coordination with internal and external interested parties such as authorities, external interest groups and forums, suppliers and clients (see [5.5](ISO_27002_2022_5.5_OT%20Contact%20with%20authorities.md) and [5.6](ISO_27002_2022_5.6_OT%20Contact%20with%20special%20interest%20groups.md)); 

e\) logging incident management activities; 

f\) handling of evidence (see [5.28](ISO_27002_2022_5.28_OT%20Collection%20of%20evidence.md));

g\) root cause analysis or post-mortem procedures;

h\) identification of lessons learned and any improvements to the incident management procedures or information security controls in general that are required.

**Reporting procedures**

Reporting procedures should include:

a\) actions to be taken in case of an information security event (e.g. noting all pertinent details immediately such as malfunction occurring and messages on screen, immediately reporting to the point of contact and only taking coordinated actions);

b\) use of incident forms to support personnel to perform all necessary actions when reporting information security incidents;

c\) suitable feedback processes to ensure that those persons reporting information security events are notified, to the extent possible, of outcomes after the issue has been addressed and closed;

d\) creation of incident reports.

Any external requirements on reporting of incidents to relevant interested parties within the defined time frame (e.g. breach notification requirements to regulators) should be considered when implementing incident management procedures.

**Other information**

Information security incidents can transcend organizational and national boundaries. To respond to such incidents, it is beneficial to coordinate response and share information about these incidents with external organizations as appropriate.

Detailed guidance on information security incident management is provided in the ISO/IEC 27035 series.