iso.org
Referenced sections
- ISMS requirements source that includes the Annex A incident-management controls supported by ISO/IEC 27035 process guidance.
"Information security management systems — Requirements"
By Sorena AIPublished Updated
ISO/IEC 27035
ISO/IEC 27035
Plain-language ISO/IEC 27035 guide to incident preparation, detection, assessment, response, evidence, escalation, recovery, and lessons learned.
- Part 1: principles
- Part 2: preparation
- Part 3: ICT response
- Incident process
Understand ISO/IEC 27035
Use the ISO/IEC 27035 standards series to prepare for, detect, report, assess, respond to, and learn from .
The current published series combines Part 1, Edition 2 (February 2023), for principles and the five-phase process; Part 2, Edition 2 (February 2023), for planning, preparation, testing, and lessons learned; and Part 3, Edition 1 (September 2020), for ICT response operations. Part 3 is limited to and remains the published edition after ISO closed its systematic review on 3 December 2025; the broader Part 1 process can also cover non-ICT events such as lost paper records. ISO/IEC 27035 is voluntary guidance, not a law or standalone certification scheme. Legal reporting duties, contracts, and continuity plans must be assessed separately.
Start with an event report. Record the incident coordinator's decision, then give every classification, action, escalation, communication, recovery, and closure decision an owner, timestamp, rationale, supporting evidence, and reassessment trigger.
Quick scan
Incident lifecycle
Prepare, detect, report, assess, respond, recover, and learn with ownership and evidence at each handoff.
Severity and timers
Set organization-specific severity criteria, escalation authority, reassessment triggers, and separate legal or contractual notification clocks.
Evidence log
Preserve the event report, classification decision, incident chronology, response actions, notifications, evidence handling, closure, and follow-up.
Implementation decisions
- 1
Incident lifecycle
Prepare, detect, report, assess, respond, recover, and learn with ownership and evidence at each handoff.
- 2
Severity and timers
Set organization-specific severity criteria, escalation authority, reassessment triggers, and separate legal or contractual notification clocks.
- 3
Evidence log
Preserve the event report, classification decision, incident chronology, response actions, notifications, evidence handling, closure, and follow-up.
Choose the next incident-management decision
Start with the series and lifecycle, then move to preparation, live response, evidence and escalation, external obligations, or a focused comparison. These pages explain the published standards but do not replace them or determine duties under applicable law.
Start here: understand the series and lifecycle
Understand what Parts 1, 2, and 3 cover, how an organization decides whether an event is an incident, and how the five management phases connect to ICT response operations.
Prepare and operate the response
Turn the lifecycle into an owned plan, tested playbooks, clear handoffs, and an operational workflow for detection through recovery.
Classify, escalate, and preserve evidence
Define severity criteria, escalation authority, decision records, and evidence handling before an incident requires time-sensitive decisions.
Connect ISO/IEC 27035 to other requirements
Keep voluntary incident-management guidance distinct from laws, certifiable management-system standards, continuity requirements, and other response frameworks.
Sources
iso.org
Referenced sections
- Implementation guidance for information security controls, including the incident-management control set.
"Information security controls"
iso.org
Referenced sections
- ISO's current published listing identifies Edition 2, published in February 2023, as the foundation of the series and describes its generic five-phase incident-management process.
"preparing for, detecting, reporting, assessing, and responding to incidents"
iso.org
Referenced sections
- ISO's current published listing identifies Edition 2, published in February 2023, and covers policy, the incident-management plan, teams, relationships, support, training, testing, and lessons learned.
"plan and prepare for incident response and to learn lessons"
iso.org
Referenced sections
- ISO's listing identifies the 2020 first edition for ICT detection, reporting, triage, analysis, containment, eradication, recovery, and conclusion. It records the close of systematic review on 3 December 2025 and continues to list this edition as published.
"information security incident response in ICT security operations"
Next steps
Build a cited ISO/IEC 27035 workflow
Assign owners to the policy, plan, response roles, incident records, exercises, and improvement actions, then connect each item to the applicable standard or external duty.
- Start from the ISO/IEC 27035 page that matches the decision or evidence gap.
- Open Research Copilot for interpretation questions tied to cited sources.
- Keep evidence, owners, and review history together in a single source of truth.
- Open Research Copilot
Answer ISO/IEC 27035 scope and interpretation questions with cited outputs.
- Open SSOT
Keep ISO/IEC 27035 evidence, decisions, and control records in one governed system.
- Talk through implementation
Review scope, evidence gaps, and next implementation steps.