ISO 27002:2022 – Control 5.25 – Assessment and Decision on Information Security Events

Purpose of Control 5.25

Control 5.25 deals with an organisation’s ability to assess information security events and further categorise them as information security incidents, to be prioritised and dealt with as such by all relevant processes and personnel.

Attributes Table of Control 5.25

5.25 is a detective control that maintains risk by ensuring that information security events are correctly categorised and prioritised as information security incidents, based on event-specific variables.

Ownership of Control 5.25

Incident Management, in broader terms, is usually applicable to service-related incidents. Given that Control 5.25 deals specifically with information security-related incidents and breaches, taking into account the highly sensitive nature of these events, ownership of Control 5.25 should ideally reside with a CISO, or organisational equivalent.

Given that CISOs are usually only seen within larger companies and enterprise-level organisations, ownership could also reside with the COO, or Service Manager, depending on the nature of the organisation.

General Guidance on Control 5.25

Instead of listing specific guidance points, Control 5.25 discusses a qualitative approach to information security incident management that provides organisations with a broad operational scope:

1. Organisations should collaborate to agree upon a clear categorisation system that escalates information security events to information security incidents, as distinct from one another.
2. The categorisation process should include a point of contact who assesses information security events using the categorisation scheme.
3. Technical personnel with the relevant skills and tools to analyse and resolve information security incidents should be involved in the assessment process.
4. All parties should collaborate to make a decision on whether or not an event warrants escalation to an incident.
5. Conversations, assessments and categorisations should be recorded to inform an organisation’s decision on future information security events and incidents.

Changes and Differences from ISO 27002:2013

27002:2022-5.25 replaces 27002:2013-16.1.4 (Assessment of and decision on information security events).

27002:2022-5.25 adheres to the same underlying operational principles as 27002:2013-16.1.4, with one small deviations.

27002:2013-16.1.4 refers to an information security incident response team (ISIRT) as being involved in the categorisation and escalation process. 27002:2022-5.25 makes reference to any staff members who are involved in analysing and resolving information security incidents.

In addition, 27002:2022-5.25 draws attention to the adequate categorisation of events, prior to escalation.

New ISO 27002 Controls

How ISMS.online Helps

With ISMS.online, ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process, from defining the scope of your ISMS through risk identification and control implementation.

Get in touch today to book a demo.