Control 5.27 establishes incident management as an organic, ongoing process where information learned from information security events and incidents is used to inform actions on subsequent incidents – whether the feedback is technical in nature, or relating to one or more internal processes, procedures or controls.
The overarching goal of Control 5.27 is to use any information obtained to minimise the likelihood of recurring incidents, and/or mitigate the internal and external consequences should they reoccur.
5.27 is a corrective control that maintains risk by creating procedures which categorise and learn from previous incidents, and reduce the “likelihood or consequences” of future incidents.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality #Integrity #Availability | #Identify #Protect | #Information Security Event Management | #Defence |
Given that Control 5.27 concerns itself with the modification of existing processes, ownership should reside with the member of the senior management team whose remit includes oversight of all incident management-related activities.
Control 5.27 stipulates that organisations should create incident management procedures that categorise and monitor three main elements of information security incidents, across their entire operation:
Information security incidents should be thoroughly analysed following closure, to create procedures that:
Supporting controls:
27002:2022-5.27 replaces 27002:2013-16.1.6 (Learning from information security incidents), and adheres to much the same approach as its predecessor.
27002:2022-5.27 contains similar guidance on the need to record information pertaining to the type, volume and cost of information security incidents, but doesn’t single out improving so-called “high impact” incidents as the end goal of the control, as is the case in 27002:2013-16.1.6. Instead, 27002:2022-5.27 concerns itself with all levels of information security incidents.
Our world-class information security management system software platform makes it super easy to understand what needs to be done and how to do it.
We take the pain out of managing your compliance requirements.
With ISMS.online, ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process, from defining the scope of your ISMS through risk identification and control implementation.
Get in touch today to book a demo.
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | New | Threat intelligence |
| 5.23 | New | Information security for use of cloud services |
| 5.30 | New | ICT readiness for business continuity |
| 7.4 | New | Physical security monitoring |
| 8.9 | New | Configuration management |
| 8.10 | New | Information deletion |
| 8.11 | New | Data masking |
| 8.12 | New | Data leakage prevention |
| 8.16 | New | Monitoring activities |
| 8.23 | New | Web filtering |
| 8.28 | New | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | New | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
