Search every question across sub-FAQs

Link each lesson to the incident report, timeline, exercise observation, vulnerability, metric, or repeated event pattern that supports it. Keep the proposed change, affected control or plan element, risk, owner, priority, due date, dependency, approval, implementation evidence, and effectiveness result.

Preserve decisions not to act. The record should identify the decision authority, rationale, residual risk, review trigger, and any compensating action instead of making the recommendation disappear.

The incident coordinator and incident management team should assemble the evidence and propose improvements. The owner who controls the affected system, process, supplier, control, budget, or policy should accept the action; the relevant risk or management authority should approve rejection, deferral, or residual risk.

Include affected responders and business owners when validating the finding. Legal, privacy, human resources, communications, safety, continuity, or supplier owners should join only when the lesson falls within their responsibility.

Begin after the incident is resolved and enough evidence is stable for useful analysis. Do not wait for one large incident: ISO/IEC 27035 also supports learning from multiple incidents, reported vulnerabilities, exercises, and performance data.

Review open actions at planned intervals and when their assumptions, risk, owner, dependency, or target system changes. Close an action only after checking the agreed acceptance criteria and recording the result.

ISO/IEC 27035-1:2023 makes learning lessons part of the generic incident-management process for organizations of any type, size, or nature. ISO/IEC 27035-2:2023 provides the detailed improvement activities: review the plan, evaluate team performance, improve control implementation, update risk assessment and management-review inputs, strengthen awareness and training, and improve relationships, tools, and metrics. ISO/IEC 27035-3:2020 supplies operational evidence from ICT response.

The standards do not prescribe a universal meeting deadline, review period, action due date, or closure threshold. The organization should set a cadence proportional to incident risk and capability needs. A severe or novel incident can justify an immediate review; recurring low-impact events can be aggregated; urgent containment and control fixes should proceed without waiting for the full lessons cycle.

Keep the controlling law, contract, policy, or authority instruction beside the decision record. Record the covered entity or service, jurisdiction, incident category, threshold analysis, facts known at the time, when any reporting clock began, decision owner, approver, recipients, submission channel, content and attachments sent, delivery evidence, acknowledgement, and required updates or final reports. A point of contact can receive the report, but the notification matrix should identify who has authority to decide and submit each external notice.

Preserve decisions not to notify. The record should identify the threshold applied, facts and uncertainty considered, legal or contractual review where needed, approval, and the change in facts that would trigger reassessment. ISO/IEC 27035 organizes this work but does not supply the external deadline or reporting threshold.

Test the notification procedure in exercises and sample completed incidents. A reviewer should be able to trace the alert or incident through threshold assessment, approval, submission, acknowledgement, follow-up, and closure without reconstructing the record from personal mailboxes.

Maintain a notification matrix by jurisdiction, entity, service, incident type, recipient, threshold, clock-start rule, channel, required content, approver, update cadence, and evidence location. Legal or regulatory owners should verify entries when the controlling source changes.

The incident coordinator should assemble the operational facts and keep the record moving. The person authorized under the controlling law, contract, or policy should decide or approve the notification; that can involve legal, privacy, regulatory, customer, insurance, communications, or business leadership.

Predefine substitutes and emergency authority. Approval must not become an avoidable delay where a deadline applies, and the incident team should continue containment and evidence preservation while the notification decision is pending.

Reassess whenever new facts change the affected systems, people, geography, duration, impact, cause, or confidence in the original analysis. Also reassess when containment fails, a supplier supplies new facts, another authority becomes relevant, or the controlling rule requires an update or final report.

Do not silently replace the first decision. Add a timestamped decision showing what changed, which threshold was reconsidered, who approved the result, and whether another communication is due.

ISO/IEC 27035-1:2023 supplies the generic incident-management process and core roles. ISO/IEC 27035-2:2023 covers policy, plans, relationships, legal and regulatory considerations, recordkeeping, forms, exercises, and lessons learned. ISO/IEC 27035-3:2020 covers ICT notification, triage, internal reporting, external reporting where required, and report storage. These editions apply when the organization adopts or is contractually required to use them; the standards do not set a statutory commencement date.

No ISO/IEC 27035 part supplies one global threshold or deadline for external notice. The controlling jurisdiction, regulated entity or service, affected people, contract, insurer term, or authority instruction determines whether a report is required, when its clock starts, what it must contain, and whether interim, corrected, or final reports are due. Treat ISO as the operating framework and the external rule as the source of the duty.

After recovery, create a timeline from event and incident records and compare actual detection, assessment, decisions, response, communications, recovery, and evidence handling with the plan. Include the incident coordinator, relevant responders, affected business or service owners, providers, control owners, and the incident management team members needed to route improvements.

The depth should match the incident's nature and severity. Separate urgent remediation from longer-term improvements, and record unresolved facts rather than forcing a final cause. Each action needs a risk-based priority, owner, due date, acceptance criteria, dependency, evidence, and closure authority.

Keep the reviewed timeline, participants, evidence consulted, scope and limitations, confirmed findings, unresolved questions, causes and contributing conditions where supported, what worked, failed controls or handoffs, and recommended actions. Link the review to the incident report without duplicating sensitive evidence unnecessarily.

Distinguish facts from hypotheses and recommendations. If legal privilege, personnel confidentiality, law-enforcement restrictions, or supplier terms limit circulation, retain a controlled full record and an appropriate operational version rather than omitting the limitation.

The incident coordinator should ensure the post-incident activity occurs and that the incident report is complete. A reviewer with enough independence to challenge the response should lead or validate significant reviews, while affected teams confirm factual accuracy.

The owner with authority over each affected control, service, supplier, policy, or budget should accept the related action. The appropriate risk or management authority should approve rejected, deferred, or residual-risk decisions.

Start after recovery when the incident's nature and severity justify a dedicated review and the essential records and participants are available. Immediate containment or safety actions should not wait for the review, and a complex investigation may require an interim review before all facts are final.

The meeting or report can close once its scope, evidence limits, findings, and actions are approved. Corrective actions remain open in their tracking system until implemented, evidenced, and checked against their acceptance criteria.

ISO/IEC 27035-1:2023 defines the generic process and its records, including the incident-management log and incident report. ISO/IEC 27035-2:2023 provides the detailed lessons-learned activities for the plan, teams, controls, risk assessment, management review, training, relationships, tools, and metrics. ISO/IEC 27035-3:2020 provides ICT operational evidence from notification, triage, analysis, containment, eradication, recovery, and reporting.

The standards apply globally to organizations of any type, size, or nature and can be adapted to risk and resources. They do not require the same meeting for every event, prescribe a fixed review deadline, or create legal privilege. The organization should define which incident types, severity levels, near misses, failed exercises, or recurring patterns trigger a dedicated review and should apply separate employment, privacy, litigation, regulatory, contractual, and evidence rules.

Preserve the event report, incident management log, classification and escalation decisions, response actions, communications, notification records, recovery validation, incident report, lessons learned, and linked evidence needed to reconstruct the case. Maintain an incident register for oversight and trend analysis. Raw telemetry, working notes, malware samples, exports, and forensic images can need different storage, access, and retention rules.

ISO/IEC 27035 does not set a universal number of days or years. Define retention by record purpose, investigation and operational need, applicable law and contracts, privacy and employment rules, limitation periods, insurance terms, and litigation or regulatory holds. A hold is an authorized instruction that suspends ordinary disposal for specified material. Document which rule wins when periods conflict.