ISO 27035 LIM study guide
ISO 27035 LIM · Work through your exam, one topic at a time.
The PECB Certified ISO/IEC 27035 Lead Incident Manager credential is aimed at professionals who want to prove they can help an organization set up and run a process for managing information security incidents. The training course is built on the ISO/IEC 27035 series and other good practices, and it follows the whole incident lifecycle from planning through post-incident activities. The ISO 27035 LIM study guide has 6 sections and about 1,874 words.
01Fundamental principles and concepts of information security incident management
ISO/IEC 27035 draws a deliberate line between an information security event - an identified occurrence indicating a possible breach of policy or failure of safeguards - and an information security incident , a single event or series of events with a significant probability of compromising business operations and threatening information security. A vulnerability is a weakness that could be exploited; it becomes an incident only through an event.
379 words, about 2 min02Information security incident management process based on ISO/IEC 27035
ISO/IEC 27035-1 describes incident management as five phases that repeat rather than form a waterfall: Plan and prepare - policy, scheme, roles, resources, awareness and testing; output is a capable organisation. Detection and reporting - monitoring and a known reporting route; every report gets an initial record with time, reporter and description.
309 words, about 2 min03Designing and developing an organizational incident management process based on ISO/IEC 27035
Design begins with the organisation's context: legal and regulatory duties (privacy breach notification deadlines, sector rules, contractual notification windows), risk appetite, size, technology estate and existing structures such as the service desk, security operations, BCM and HR. Top management must approve the incident management policy and provide authority, resources and a named owner.
296 words, about 1 min04Preparing and executing the incident response plan for information security incidents
The incident response plan operationalises the policy. Typical contents: purpose, scope and activation criteria; severity definitions and response targets; roles, deputies and 24/7 contact routes; escalation and notification matrix; playbooks for common scenarios (ransomware, phishing, lost device, insider, DDoS); communication templates for staff, customers, regulators and media; evidence handling instructions; tooling and access; and a testing schedule.
286 words, about 1 min05Implementing incident management processes and managing information security incidents
Implementation turns design into routine: one intake point for reports, a ticket for every event including false positives, triage against agreed criteria, and a named incident manager with authority to escalate. The incident record should capture what was known, what was decided, by whom and when - memory reconstructs badly after a long night.
286 words, about 1 min06Improving the incident management processes and activities
ISO/IEC 27035 places lessons learned inside the process. After containment and recovery, hold a post-incident review promptly, while memory is fresh, with responders, the affected business owner and, where relevant, legal and privacy.
318 words, about 2 min