## 5.26 Response to information security incidents

  

| Control type | Information security properties           | Cybersecurity concepts | Operational capabilities               | Security domains |
| ------------ | ----------------------------------------- | ---------------------- | -------------------------------------- | ---------------- |
| #Corrective  | #Confidentiality #Integrity #Availability | #Respond #Recover      | #Information_security_event_management | #Defence         |


**Control**
Information security incidents should be responded to in accordance with the documented procedures.

**Purpose**
To ensure efficient and effective response to information security incidents.

**Guidance**
The organization should establish and communicate procedures on information security incident response to all relevant interested parties.

Information security incidents should be responded to by a designated team with the required competency (see 5.24).

The response should include the following:

a\) containing, if the consequences of the incident can spread, the systems affected by the incident;
b\) collecting evidence (see 5.28) as soon as possible after the occurrence;
c\) escalation, as required including crisis management activities and possibly invoking business continuity plans (see 5.29and 5.30);
d\) ensuring that all involved response activities are properly logged for later analysis;
e\) communicating the existence of the information security incident or any relevant details thereof to all relevant internal and external interested parties following the need-to-know principle;
f\) coordinating with internal and external parties such as authorities, external interest groups and forums, suppliers and clients to improve response effectiveness and help to minimize consequences for other organizations;
g\) once the incident has been successfully addressed, formally closing and recording it;
h\) conducting information security forensic analysis, as required (see 5.28);
i\) performing post-incident analysis to identify root cause. Ensure it is documented and communicated according to defined procedures (see 5.27);
j\) identifying and managing information security vulnerabilities and weaknesses including those related to controls which have caused, contributed to or failed to prevent the incident.

**Other information**
The ISO/IEC 27035 series provides further guidance on incident management.