ISO/IEC 27035 FAQ CSIRT Roles

Assign an incident management team (IMT) to maintain the capability and an incident coordinator to lead each case. Define internal or external incident response teams (IRTs), points of contact, monitoring, business and asset owners, legal and privacy advisers, communications, continuity, HR, evidence specialists, and crisis management as the organization needs them.

ISO/IEC 27035-1 treats a computer security incident response team as one possible IRT, while ISO/IEC 27035-3 recommends establishing a CSIRT for ICT incident response operations. Smaller organizations and outsourced environments can combine roles, but authority, availability, conflicts, supplier handoffs, and accountability should remain explicit. The plan should show who acts, who approves, who is informed, and who can accept residual risk.

Keep approved terms of reference, a responsibility matrix, contact and backup roster, on-call coverage, authority limits, skills and training records, supplier responsibilities, communication routes, and exercise results. Incident records should show that named roles accepted handoffs and used their authority in practice.

For outsourced response, map the provider's service description and escalation commitments to the organization's own decision rights. The provider can perform response work, but the organization still needs owners for business impact, legal duties, public communications, risk acceptance, and incident closure.

The incident coordinator directs response activity and coordinates the IRTs, while the IMT maintains oversight, reporting, and the incident-management capability. Technical responders should have pre-approved authority for urgent actions within defined boundaries.

Actions with material financial, operational, safety, legal, privacy, or reputational effects should move to the specified business or management authority. The plan should state who can isolate systems, interrupt services, engage external support, communicate externally, accept residual risk, and close the incident.

Review roles after incidents and exercises and whenever systems, services, suppliers, organization structure, working hours, contact routes, legal duties, or crisis arrangements change. Check both the written assignment and whether the people remain available, trained, and authorized.

Use exercise and incident evidence to find unclear authority, slow approvals, missing skills, overloaded individuals, and failed supplier handoffs. Assign corrective actions and retest the affected path.