Learning from information security incidents

What the control asks

What the organization learns from its information security incidents is to be fed back to strengthen and improve its security controls. Purpose: make future incidents less likely or less damaging. Guidance: set up procedures to measure and track the kinds, numbers and costs of incidents. Use what incident evaluation reveals to improve the incident management plan with its scenarios and procedures (5.24); to spot incidents that recur or are serious, and their causes, so the risk assessment is updated and additional controls are chosen and implemented to cut the likelihood or impact of similar events, supported by gathering and tracking data on incident types, volumes and costs; and to enrich user awareness and training (6.3) using real cases that show the possible harm, the right reaction and ways to stop a recurrence. ISO/IEC 27035 carries more on this.

Purpose in the standard’s terms, in our words: Makes future incidents less likely or less harmful.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Identify, Protect; Information security event management; Defence.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• A procedure for quantifying and monitoring incident types, volumes and costs, with the resulting metrics or dashboards
• Post-incident review reports identifying causes and recommended improvements
• Changes to the risk assessment and to the risk treatment plan, each traced back to the incident that prompted it
• Records of new or strengthened controls implemented after recurring or serious incidents
• Revisions to the incident management plan and scenarios informed by incidents
• Awareness and training material that uses real incident examples

Where audits commonly find gaps

• Incident costs are never captured, so trends and business impact are unknown
• Lessons are written up but the resulting actions are not tracked to completion
• The risk assessment is not revisited after significant incidents
• Recurring incident types are handled individually without any cause analysis

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (16.1.6) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.33 Protection of records
• 5.37 Documented operating procedures
• 5.5 Contact with authorities

Read the five attributes All 93 controls