--- title: "ISO/IEC 27035 CSIRT Roles FAQ" canonical_url: "https://www.sorena.io/artifacts/global/iso-27035/faq/csirt-roles" source_url: "https://www.sorena.io/artifacts/global/iso-27035/faq/csirt-roles" author: "Sorena AI" description: "How should teams handle CSIRT Roles under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references." published_at: "2026-05-09" updated_at: "2026-05-09" keywords: - "ISO/IEC 27035 CSIRT Roles FAQ" - "CSIRT Roles ISO/IEC 27035" - "ISO/IEC 27035 evidence" - "ISO/IEC 27035 implementation" - "ISO/IEC 27035" - "ISO/IEC 27035 Information Security Incident Management" - "ISO/IEC 27035 FAQ: CSIRT Roles" - "FAQ" - "global compliance" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # ISO/IEC 27035 CSIRT Roles FAQ How should teams handle CSIRT Roles under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. *FAQ* *Global* *ISO/IEC 27035* ## ISO/IEC 27035 FAQ CSIRT Roles How should teams handle CSIRT Roles under ISO/IEC 27035 Information Security Incident Management? Grounded in external ISO, NIST, EU, or framework sources where relevant. This is practical implementation guidance, supporting implementation planning and should be validated against jurisdiction-specific legal, contractual, and policy requirements before implementation. This FAQ explains the common CSIRT roles used in incident response and how to assign ownership for decisions, communications, legal review, evidence handling, and follow-up. ## How should teams handle CSIRT Roles under ISO/IEC 27035? Start with the operational decision: define what CSIRT Roles means in your ISO/IEC 27035 scope, who owns it, and what record proves the decision is current. In practice, CSIRT work is usually split across a lead who coordinates the response, incident handlers who verify and analyze the event, legal reviewers who check compliance and contract issues, public affairs or media relations who handle external messaging, asset owners who set recovery priorities, and third parties who may assist under contract. The incident lead should also make sure response records are safeguarded, while the communications owner keeps status updates and notifications aligned with policy and law. - Name the accountable owner and reviewer for CSIRT Roles. - Record the scope, assumptions, decision, approval date, evidence location, exception status, and next review trigger. - Escalate when CSIRT Roles changes risk acceptance, service commitments, customer promises, regulatory duties, or certification evidence. Sources for this answer: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - [ISO/IEC 27035-2:2023 standard page](https://www.iso.org/standard/78974.html?ref=sorena.io) - Primary ISO listing for planning, preparing, and lessons-learned guidance. - [NIST SP 800-61r3](https://csrc.nist.gov/pubs/sp/800/61/r3/final?ref=sorena.io) - Lists common incident response roles and responsibilities, including leadership, incident handlers, legal, public affairs and media relations, asset owners, and third parties. ## What evidence should prove CSIRT Roles is current under ISO/IEC 27035? The evidence should show the process operating. For this artifact, the strongest record usually includes incident policy, response plan, severity matrix, triage records, escalation logs, notifications, containment and recovery notes, lessons learned, and retained logs. Avoid evidence that only repeats a requirement. A reviewer should be able to see the actual owner, date, system, supplier, AI system, service, incident, risk, or control sample behind the answer. - Use source records from the system of work, not screenshots created only for audit day. - Keep exceptions visible as risk acceptance, corrective action, or management-review input. - Update linked registers when the answer changes an owner, risk, control, service, supplier, or review date. Sources for this answer: - [ISO/IEC 27035-2:2023 standard page](https://www.iso.org/standard/78974.html?ref=sorena.io) - Primary ISO listing for planning, preparing, and lessons-learned guidance. - [ISO/IEC 27035-3:2020 standard page](https://www.iso.org/standard/74033.html?ref=sorena.io) - Primary ISO listing for ICT incident response operations guidance. ## Who should approve CSIRT Roles decisions under ISO/IEC 27035? The person who can fund, operate, and correct the process should own the decision; governance should review consistency and exceptions. For high-impact changes, approval should include the teams affected by the evidence: security, privacy, resilience, supplier management, AI governance, legal, risk, or business service owners as relevant. - Use a named owner, named backup, and named escalation forum. - Separate preparation work from risk acceptance and final approval. - Keep approval records with the evidence rather than in disconnected email threads. Sources for this answer: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - [ISO/IEC 27035-2:2023 standard page](https://www.iso.org/standard/78974.html?ref=sorena.io) - Primary ISO listing for planning, preparing, and lessons-learned guidance. ## When should CSIRT Roles be reviewed under ISO/IEC 27035? Review it at planned intervals and whenever the underlying scope, service, supplier, control, risk, AI system, personal data flow, incident process, or customer commitment changes. A stale record is worse than a short record. If the facts change, update the evidence and mark what changed so the next reviewer can trust the page. - Set a planned review date and a change-trigger rule. - Use findings to update controls, procedures, contracts, risk registers, or training. - Carry unresolved items into management review or risk acceptance. Sources for this answer: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - [ISO/IEC 27035-2:2023 standard page](https://www.iso.org/standard/78974.html?ref=sorena.io) - Primary ISO listing for planning, preparing, and lessons-learned guidance. ## Primary sources - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" - [ISO/IEC 27035-2:2023 standard page](https://www.iso.org/standard/78974.html?ref=sorena.io) - Primary ISO listing for planning, preparing, and lessons-learned guidance. - Quote: "plan and prepare for incident response and to learn lessons" - [ISO/IEC 27035-3:2020 standard page](https://www.iso.org/standard/74033.html?ref=sorena.io) - Primary ISO listing for ICT incident response operations guidance. - Quote: "information security incident response in ICT security operations" ## Topic Guides - [ISO/IEC 27035 Compliance Guide](/artifacts/global/iso-27035/compliance.md): ISO/IEC 27035 Compliance for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Escalation FAQ](/artifacts/global/iso-27035/faq/escalation.md): How should teams handle Escalation under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Event vs Incident FAQ](/artifacts/global/iso-27035/faq/event-vs-incident.md): How should teams distinguish a security event from an information security incident under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Evidence Log Template and Workflow](/artifacts/global/iso-27035/evidence-log-template.md): ISO/IEC 27035 Evidence Log Template for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Incident Lifecycle Guide](/artifacts/global/iso-27035/incident-lifecycle.md): ISO/IEC 27035 Incident Lifecycle for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Incident Lifecycle Workflow](/artifacts/global/iso-27035/incident-lifecycle-workflow.md): ISO/IEC 27035 Incident Lifecycle Workflow for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Incident Management FAQ](/artifacts/global/iso-27035/faq.md): ISO/IEC 27035 FAQ for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Incident Response Playbook](/artifacts/global/iso-27035/incident-response-playbook.md): ISO/IEC 27035 Incident Response Playbook for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Incident Severity and Escalation Matrix](/artifacts/global/iso-27035/incident-severity-and-escalation-matrix.md): ISO/IEC 27035 Incident Severity and Escalation Matrix for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Incident Timer Workflow Template and Workflow](/artifacts/global/iso-27035/incident-timer-workflow.md): ISO/IEC 27035 Incident Timer Workflow for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Lessons Learned FAQ](/artifacts/global/iso-27035/faq/lessons-learned.md): How should teams handle Lessons Learned under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Notification Evidence FAQ](/artifacts/global/iso-27035/faq/notification-evidence.md): How should teams handle Notification Evidence under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Notification Threshold Mapping Guide](/artifacts/global/iso-27035/notification-threshold-mapping.md): ISO/IEC 27035 Notification Threshold Mapping for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Post Incident Review FAQ](/artifacts/global/iso-27035/faq/post-incident-review.md): How should teams handle Post Incident Review under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Retained Logs FAQ](/artifacts/global/iso-27035/faq/retained-logs.md): How should teams handle Retained Logs under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Severity Classification FAQ](/artifacts/global/iso-27035/faq/severity-classification.md): How should teams handle Severity Classification under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 vs ISO 22301 Comparison](/artifacts/global/iso-27035/iso-27035-vs-iso-22301.md): ISO/IEC 27035 vs ISO 22301 for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 vs NIS2 Comparison](/artifacts/global/iso-27035/iso-27035-vs-nis2.md): ISO/IEC 27035 vs NIS2 for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 vs NIST SP 800-61 Comparison](/artifacts/global/iso-27035/iso-27035-vs-nist-800-61.md): ISO/IEC 27035 vs NIST SP 800-61 for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 vs NIST SP 800-61 Rev. 3 Comparison](/artifacts/global/iso-27035/iso-27035-vs-nist-800-61r3.md): ISO/IEC 27035 vs NIST SP 800-61 Rev. 3 for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. *Recommended next step* *Placement: after implementation guidance* ## Operationalize ISO/IEC 27035 FAQ: CSIRT Roles This page moves ISO/IEC 27035 guidance into an auditable operating loop with owners, evidence requests, decision records, and scheduled review dates. - [Open Assessment Autopilot for ISO/IEC 27035](/solutions/assessment.md): Convert ISO/IEC 27035 FAQ: CSIRT Roles into accountable tasks, evidence requests, and review checkpoints. - [Talk through ISO/IEC 27035 CSIRT Roles implementation](/contact.md): Review ISO/IEC 27035 CSIRT role scope, evidence gaps, ownership, escalation paths, and next implementation steps. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/global/iso-27035/faq/csirt-roles