Information security incident management process based on ISO/IEC 27035
The five-phase process
ISO/IEC 27035-1 describes incident management as five phases that repeat rather than form a waterfall:
- Plan and prepare - policy, scheme, roles, resources, awareness and testing; output is a capable organisation.
- Detection and reporting - monitoring and a known reporting route; every report gets an initial record with time, reporter and description.
- Assessment and decision - verify, triage, classify by type and severity, decide whether it is an incident, escalate and authorise a response.
- Responses - immediate containment, investigation, eradication, recovery, communication and evidence preservation.
- Lessons learned - review, root cause, corrective actions, update the scheme.
Each phase has entry criteria and outputs; the incident record is the thread running through all five.
Interfaces
The process connects to risk management (incidents feed the risk register), business continuity (major incidents may invoke the BCP), change management (emergency changes need retrospective approval) and legal/privacy notification. ISO/IEC 27035-3 adds guidance on ICT incident response operations.
Worked example
Monitoring flags unusual outbound traffic. Detection records it; assessment confirms data transfer to an unknown host, classifies it as a confidentiality incident at critical severity; response isolates the host, resets credentials and preserves logs; lessons learned finds an unpatched VPN appliance and triggers a patch campaign. Assessment decided what it was before anyone rebuilt a server.
Traps
Jumping from detection straight to response without a documented decision. Closing tickets at recovery and never reaching lessons learned. Confusing process phases with organisational departments.