ISO 27035 LIM study plan
ISO 27035 LIM · Give each week a clear focus.
8 weeks · About 6 hours per week
Fundamental principles and concepts of information security incident management & Information security incident management process based on ISO/IEC 27035
Define information security incident, event, and vulnerability in your own words and state the boundary between them
Map the ISO/IEC 27035 lifecycle stages (plan and prepare, detection and reporting, assessment and decision, responses, lessons learned) onto a diagram you draw from memory
Explain how ISO/IEC 27035 relates to ISO/IEC 27001 corrective action and to ISO/IEC 27002 controls for incident management
Identify at least five stakeholders in incident management and describe their decision rights
List the core principles: consistent process, defined roles, evidence handling, proportionality, and continuous improvement
Your checkpoint
A one-page terminology and lifecycle map (drawn by hand) plus a 300-word written comparison of ISO/IEC 27035 with ISO/IEC 27001 and 27002 incident-related requirements
Information security incident management process based on ISO/IEC 27035 & Designing and developing an organizational incident management process based on ISO/IEC 27035
Sequence the process stages in order and state the inputs, activities, and outputs of each stage
Distinguish incident detection, reporting, assessment, and decision points, and describe who decides whether an event becomes an incident
Draft an escalation matrix with severity levels and response time targets for three severity tiers
Define criteria for classifying incidents by impact type (confidentiality, integrity, availability, privacy, regulatory)
Describe how a policy, a process, and a procedure differ and which one governs each stage
Your checkpoint
A process flow document with stage-by-stage inputs, outputs, owners, and a severity and escalation table covering at least three tiers
Designing and developing an organizational incident management process based on ISO/IEC 27035 & Preparing and executing the incident response plan for information security incidents
Write the scope, objectives, and management commitment clauses of an incident management policy
Design a role structure (incident manager, response team, communications lead, legal and privacy, business owner) with defined responsibilities
Produce a communication plan template covering internal escalation, customer notification, and regulator notification triggers
Draft an evidence-handling rule set covering chain of custody, hashing, and storage
Identify the legal, regulatory, and contractual notification obligations that apply to a typical organization
Your checkpoint
A draft incident management policy of 800-1,200 words with a roles and responsibilities matrix and a notification trigger table
Preparing and executing the incident response plan for information security incidents & Implementing incident management processes and managing information security incidents
Write a response playbook for one scenario (for example ransomware or credential compromise) with containment, eradication, and recovery steps
Describe how to preserve volatile evidence before containment actions and justify the trade-off
Practice decision-making under uncertainty using a written tabletop scenario and record the decisions taken
Explain how to coordinate with external parties such as law enforcement, forensics providers, and regulators during an active incident
Define closure criteria and the transition from response to recovery and normal operations
Your checkpoint
One complete playbook of 600-1,000 words plus a written tabletop exercise record with at least ten decisions and their rationale
Implementing incident management processes and managing information security incidents & Improving the incident management processes and activities
Explain how to log, track, and report incidents through their full lifecycle in an incident register
Describe metrics that measure process performance (time to detect, time to contain, volume by severity, recurrence rate)
Design a lessons-learned review process with defined timing, participants, and outputs
Distinguish corrective, preventive, and improvement actions and show how they feed a management review
Describe how to measure and improve incident response capability over time
Your checkpoint
An incident register template with at least eight fields and a metrics dashboard specification listing five metrics with definitions and targets
Improving the incident management processes and activities & Designing and developing an organizational incident management process based on ISO/IEC 27035
Design an exercise program covering tabletop, simulation, and technical drills, with frequency and scope
Define the inputs to and outputs of a management review of incident management performance
Explain how audit findings and nonconformities drive changes to the process and the policy
Describe how to build a training and awareness plan for responders and for general staff
Identify indicators that a process is degrading and propose corrective actions
Your checkpoint
A 12-month exercise and training calendar with objectives, participants, and success criteria for each activity
Fundamental principles and concepts of information security incident management & Information security incident management process based on ISO/IEC 27035 & Designing and developing an organizational incident management process based on ISO/IEC 27035 & Preparing and executing the incident response plan for information security incidents & Implementing incident management processes and managing information security incidents & Improving the incident management processes and activities
Answer 60-100 practice questions across all domains and record accuracy per domain
Re-derive the lifecycle model and the process stage table from memory without notes
Revisit the two weakest domains and write a one-page summary of each from memory
Identify and correct at least five recurring misconceptions found in your practice results
Rehearse explaining the difference between an event, an incident, and a breach in under two minutes
Your checkpoint
A scored practice test record with per-domain accuracy and a one-page list of corrected misconceptions
Fundamental principles and concepts of information security incident management & Information security incident management process based on ISO/IEC 27035 & Designing and developing an organizational incident management process based on ISO/IEC 27035 & Preparing and executing the incident response plan for information security incidents & Implementing incident management processes and managing information security incidents & Improving the incident management processes and activities
Complete two full timed practice exams and compare results against week 7
Review every missed question and trace it back to the specific clause or concept
Recite the process stages, severity criteria, and notification triggers from memory
Confirm readiness against a written checklist of all six domains
Plan the final 48 hours before the exam with a short review schedule
Your checkpoint
Two completed timed practice exams with a final readiness checklist signed off per domain
Milestones
Week 2: You can draw the full lifecycle and list each stage's inputs and outputs from memory without notes
Week 4: You have a policy draft, a roles matrix, and one complete playbook, and you have run a written tabletop exercise
Week 6: You have an incident register, a metrics specification, and a 12-month exercise and training calendar
Week 7: Practice accuracy is at or above 70% overall and no domain falls below 60%
Week 8: Two timed practice exams completed with stable or improving scores and all six domains signed off on the readiness checklist