## 5.25 Assessment and decision on information security events

  

| Control type | Information security properties           | Cybersecurity concepts | Operational capabilities               | Security domains |
| ------------ | ----------------------------------------- | ---------------------- | -------------------------------------- | ---------------- |
| #Detective   | #Confidentiality #Integrity #Availability | #Detect #Respond       | #Information_security_event_management | #Defence         |

  

**Control**
The organization should assess information security events and decide if they are to be categorized as information security incidents.

  

**Purpose**

  

To ensure effective categorization and prioritization of information security events.

  

**Guidance**

  

A categorization and prioritization scheme of information security incidents should be agreed for the identification of the consequences and priority of an incident. The scheme should include the criteria to categorize events as information security incidents. The point of contact should assess each information security event using the agreed scheme.

Personnel responsible for coordinating and responding to information security incidents should perform the assessment and make a decision on information security events.

Results of the assessment and decision should be recorded in detail for the purpose of future reference and verification.

**Other information**
The ISO/IEC 27035 series provides further guidance on incident management.