ISO 27002:2022 – Control 5.26 – Response to Information Security Incidents

Purpose of Control 5.26

Control 5.26 helps organisations to ensure that internal and external personnel are fully engaged with published incident management processes and procedures (largely those created in Control 5.24), thereby maximising the possibility of a fast, effective resolution.

Attributes Table

5.26 is a corrective control that modifies risk by ensuring that information security incidents are responded to through strict adherence to company procedures.

Ownership of Control 5.26

Ownership of Control 5.26 should reside with a member of the senior management team whose remit includes oversight of all incident management-related activities, such as a COO or Head of Service Delivery.

The owner should also be able to directly or indirectly manage the performance of personnel who are involved in the analysis and resolution of information security-related incidents, to drive performance management and eliminate errors.

General Guidance on Control 5.26

Control 5.26 explicitly states that information security incidents should be dealt with by a dedicated team who holds the “required competency” to affect fast and thorough resolution of any incidents that come their way (see Control 5.24).

Control 5.26 outlines 10 main guidance points to ensure that incident management procedures are adhered to:

1. Containment and mitigation of any threats arising from the original event.
2. Collection and corroboration of evidence immediately after an information security incident has occurred.
3. Escalation, including crisis management, BUDR activities and overarching business continuity plans (see Controls 5.29 and 5.30).
4. Accurate logging of all incident-related activity, including the initial response, to aid in post mortem analysis.
5. Adhering to a strict “need to know” principle when communicating the existence of, and developments pertaining to, information security-related incidents.
6. Remaining mindful of an organisation’s responsibilities to external organisations (clients, vendors, public bodies, regulators etc.) when communicating the wider impact of information security incidents.
7. Closing an incident to a strict set of completion criteria.
8. Forensic analysis (see Control 5.28).
9. Identifying the underlying cause of an incident, once said incident has been resolved, including adequate recording and communication to all relevant parties (see Control 5.27).
10. Managing underlying vulnerabilities that have led to information security-related events and incidents, including the identification and modification of internal processes, controls, policies and procedures.

Supporting controls

• 5.24
• 5.27
• 5.28
• 5.29
• 5.30

Changes and Differences from ISO 27002:2013

27002:2022-5.26 replaces 27002:2013-16.1.5 (Response to information security incidents).

ISO 27002:2022-5.26 goes a few steps further than 27002:2013-16.1.5, with the addition of four key areas for consideration:

• The need to contain and mitigate threats arising from the original event
• Escalation procedures that are based around crisis management and business continuity
• Ascertaining precisely why the incident occured, and communicating specifics to all relevant parties
• Taking remedial action to identify and modify internal processes, controls and policies that led to the original event

27002:2013-16.1.5 also makes reference to resuming “normal security level” as the primary goal of an incident response team in the early stages of an escalation. 27002:2022-5.26 makes no such reference, and instead focuses on the general need to contain threats.

New ISO 27002 Controls

How ISMS.online Helps

The ISMS.online platform is a great tool to help you implement and manage an ISO 27002 Information Security Management System, regardless of your experience with the Standard.

Our system will guide you through the steps to successfully set up your ISMS and manage it going forward.

Get in touch today to book a demo.