Assessment and decision on information security events

What the control asks

Each information security event is to be assessed and a decision made on whether it counts as an information security incident. Purpose: categorize and prioritize security events effectively. Guidance: an agreed scheme for categorizing and prioritizing incidents should identify an incident's consequences and priority and include the criteria for treating an event as an incident. The point of contact assesses every event against that scheme, and the people responsible for coordinating and responding to incidents carry out the assessment and take the decision. The outcome of each assessment and decision is recorded in enough detail to be referred back to and checked later. ISO/IEC 27035 carries more detail on incident management.

Purpose in the standard’s terms, in our words: Ensures information security events are categorized and prioritized effectively.

Attribute values in one line: Detective; Confidentiality, Integrity, Availability; Detect, Respond; Information security event management; Defence.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• The agreed incident categorization and prioritization scheme with criteria for declaring an incident and consequence levels
• Triage records showing each reported event assessed against the scheme
• Detailed decision records identifying who assessed the event, the categorization and the rationale
• Evidence that assessors are the designated incident coordination and response personnel
• Metrics on event volumes, incidents declared and time to decision

Where audits commonly find gaps

• No written criteria for when an event becomes an incident, so decisions are inconsistent
• Events closed as non-incidents without any recorded rationale
• Triage is done by whoever receives the alert rather than designated personnel
• Priority is set by gut feel rather than a consequence-based scheme

What ISO/IEC 27028 changes for this control

It carries a single control type, detective, which sets what the evidence has to prove. Its earlier numbering (16.1.4) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.28 Collection of evidence
• 5.7 Threat intelligence
• 8.16 Monitoring activities

Read the five attributes All 93 controls