ISO 27035 LIM flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Information security incident

A single or series of unwanted or unexpected information security events with a significant probability of compromising business operations and threatening information security, requiring coordinated response.

Information security event

An identified occurrence of a system, service, or network state indicating a possible policy or control breach, or an unknown situation relevant to security; it may or may not become an incident.

Incident management team (ISIMT)

The designated group responsible for coordinating detection, assessment, response, and lessons learned for information security incidents, led by an incident manager with defined authority.

Vulnerability versus incident

A vulnerability is a weakness that may be exploited; exploitation generates events, and an event becomes an incident when it has significant probability of harming business operations or security.

ISO/IEC 27035 structure

A multi-part standard: 27035-1 covers principles and concepts, 27035-2 covers planning and preparing incident response, and 27035-3 covers ICT incident response operations.

Incident management objective

To detect, report, assess, respond to, and learn from information security incidents consistently, reducing impact and likelihood while meeting legal and regulatory obligations.

Plan and Prepare phase

The first process phase establishing policy, the incident management team, reporting channels, classification scheme, and the incident response plan before incidents occur.

Detect and Report phase

The phase in which monitoring, alerts, and human reports identify events, which are routed through a single point of contact into the incident management process.

Assess and Decide phase

The phase that evaluates a reported event against classification criteria, confirms whether it is an incident, assigns severity, and decides the response level and escalation.

Respond phase

The phase covering containment, eradication, recovery, and communication, balancing business continuity needs against preservation of evidence.

Learn Lessons phase

The final process phase producing post-incident analysis, root cause identification, and tracked improvement actions fed back into planning and preparation.

Phase entry and exit criteria

Documented conditions that determine when a process phase starts and when it is complete, including responsible roles, records produced, and time targets.

Chain of custody

A documented record of who collected, handled, transferred, and stored evidence, and when, supporting integrity and potential admissibility in investigations.

Incident classification scheme

A defined set of severity levels based on impact to confidentiality, integrity, availability, and scale, used to drive escalation, notification, and resource allocation.

Incident management policy

A management-approved document stating incident management objectives, scope, roles, authority of the response team, and mandatory reporting obligations.

Reporting channel design

Reporting routes that are simple, widely known, monitored continuously, and include an alternative path that works when primary systems are compromised.

Process interfaces

Defined links between incident management and business continuity, crisis management, IT service management, legal, HR, communications, and law enforcement.

Regulatory notification mapping

Identification of legal, regulatory, and contractual duties to notify authorities or affected parties, translated into thresholds, timelines, and approval responsibilities.

Incident response plan

A documented plan containing procedures, playbooks, contact lists, escalation matrices, and decision trees, version-controlled and available when primary systems fail.

Activation authority

The predefined role empowered to declare an incident, escalate it, convene the response team, and authorize external communications and crisis declaration.

Containment strategy

A chosen set of temporary controls such as host isolation, account disablement, or network segmentation, selected by weighing business impact against evidence preservation.

Tabletop exercise

A discussion-based simulation of a realistic incident scenario used to test roles, decisions, communications, and plan gaps without affecting production systems.

Incident closure criteria

Conditions for ending an incident: verified recovery, understood root cause, completed reporting, and improvement actions assigned with owners and dates.

Incident register

A controlled log recording every report, its classification, actions taken, decisions and rationale, evidence references, and timestamps for audit and analysis.

Triage

The consistent application of classification criteria to a reported event, documenting severity rationale and reassessing as new facts emerge.

Incident manager role

The person who owns the response process, coordination, and communications during an incident, while technical specialists perform the remediation work.

Single spokesperson model

A communication approach where one authorized individual delivers external statements using approved templates, preventing inconsistent or premature disclosure.

Detection time metric

The elapsed time between an incident occurring and its detection, used to measure monitoring effectiveness and prioritize detection improvements.

Post-incident review

A structured analysis after an incident examining timeline, root cause, response effectiveness, and lessons learned, producing tracked corrective actions.

Lessons learned feedback loop

The mechanism feeding post-incident findings into policy, classification criteria, playbooks, contacts, and training, closing the improvement cycle.

Trend analysis

Examination of incident metrics over time by type, detection and containment times, and recurrence, to reveal systemic weaknesses and prioritize improvements.

Corrective action tracking

Recording improvement actions with owners, due dates, and verification of effectiveness, ensuring post-incident findings are implemented rather than only documented.