ISO/IEC 27035 Compliance

Adoption means using the five phases in Part 1: plan and prepare; detect and report; assess and decide; respond; and learn lessons. The organization decides the scope, classification criteria, roles, authorities, communications, records, tools, and review cycle that fit its services, risk situation, size, and structure.

Part 2 turns the preparation and learning phases into an operating capability: an approved policy, an incident-management plan, an incident management team (IMT), incident response teams (IRTs) where needed, internal and external relationships, technical support, awareness, training, exercises, monitoring, and improvements. Part 3 supplies the detailed ICT operations inside the middle phases. It does not cover non-ICT response such as a lost paper document.

ISO/IEC 27035 does not impose statutory notification deadlines and is not a standalone certifiable management-system standard. It can support ISO/IEC 27001:2022 Annex A controls 5.24 through 5.28, but ISO/IEC 27001 governs an organization's information security management system and any certification against it. Applicable laws, regulatory instructions, contracts, insurance terms, and continuity plans remain separate requirements.

Parts 1 and 2 are second editions published in February 2023. Part 3 is the first edition, published in September 2020, and ISO currently lists it at the close-of-review stage. These publication dates are not statutory commencement or transition dates. When maintaining controlled procedures, confirm the current ISO edition and any law, contract, certification scope, or customer commitment that incorporates a specific edition.

A policy or standard purchase does not show that the capability works. Keep the records created during preparation, exercises, events, incidents, and improvement work. Part 1 calls for event reports, an incident-management log, and a centrally managed incident register; Part 2 adds the policy, plan, team arrangements, training, exercises, capability monitoring, and lessons-learned actions.

Each incident record should let an authorized reviewer reconstruct what was reported, what the organization knew at each decision point, whether the event was classified as an incident, who acted, how severity changed, what was communicated, which evidence was preserved, how recovery and closure were approved, and which follow-up actions remain open. Apply access, retention, confidentiality, and evidence-preservation rules appropriate to the record and any external duty.

Start with the organization's risk and operating context, not a generic maturity score. Define the capability, approve the policy and plan, establish teams and relationships, prepare the reporting and recordkeeping mechanisms, train the people in scope, and test the plan. Use exercise and incident findings to change the plan, controls, risk assessment, and team capability.

During an event, the point of contact records enough information for the incident coordinator to assess it against the approved criteria. If it is an incident, the assigned team manages the response, updates the incident log and register, reassesses classification as facts change, coordinates required communications, preserves relevant evidence, validates recovery, and records closure and follow-up.

Adoption does not by itself establish conformity with ISO/IEC 27001, compliance with a law, satisfaction of a contract, or that every incident was handled correctly. Those conclusions depend on the applicable criteria and evidence. ISO/IEC 27035 supplies guidance for the organization to tailor and operate.

Keep an information security event, an information security incident, an internal escalation, and an externally reportable incident as separate decisions. An event may be assessed and closed without becoming an incident; an incident may require internal response without meeting an external reporting threshold; and a legal clock may start under rules that use different definitions.

Set a planned review cycle for the policy, plan, contacts, classification criteria, response procedures, tools, training, and external-requirement mapping. Review sooner after an incident or exercise exposes a gap, or when services, technology, suppliers, threats, organizational structure, laws, contracts, or continuity arrangements materially change.

Part 2's lessons-learned phase covers identifying improvement areas, changing the incident-management plan and control implementation, feeding results into risk assessment and management review, and evaluating the IRT. Track each action to an owner and verify that the revised process works; recording a lesson without changing or testing anything does not show improvement.