Search every question across sub-FAQs

For records used only to manage the case, preserve authenticity, access control, version history, timestamps, and links to the incident register. For potential digital evidence, use procedures suited to the intended investigation or proceeding, including identification, collection, acquisition, preservation, integrity verification, access logs, and chain of custody.

Do not describe every operational log as forensic evidence. Apply the stronger handling process when legal prosecution, disciplinary action, litigation, regulatory review, or another evidential purpose is reasonably possible.

The incident-management owner should define the operational record set with records, system, and security owners. Legal, privacy, human resources, regulatory, insurance, and contract owners should approve the rules that fall within their authority, including holds and restrictions on personal or employee data.

The incident coordinator or evidence custodian should apply the rule to each case and record exceptions. No one should dispose of material covered by an active hold merely because the ordinary retention period expired.

Review the schedule when laws, contracts, systems, services, suppliers, storage locations, evidence needs, or incident types change. For each case, check for active investigations, claims, audits, regulator requests, or holds before disposal.

At the end of the approved period, dispose of the record securely unless a documented exception applies. Record the category, authority, date, method, scope, and person responsible without retaining unnecessary copies as proof.

Start with the event or incident record's purpose and retention trigger. An intake report can be retained from closure; a case file from incident resolution; evidence from collection or release of a hold; a notification record from submission, acknowledgement, or final resolution; and a contract-specific record from the event defined by that contract. State the trigger explicitly so the period can be calculated consistently.

Examples of distinct categories include searchable case records, security telemetry, authentication and access logs, communications, regulator submissions, malware samples, forensic images, employee-related records, supplier evidence, and lessons-learned actions. These are examples, not ISO-mandated periods. Each category can require a different owner, repository, access group, integrity control, hold rule, period, and disposal method.

Base the rating on actual or projected adverse consequences for the organization's operations, individuals, and other organizations. Useful criteria include asset or service criticality, confidentiality, integrity and availability impact, scope, affected parties, spread, threat activity, recoverability, safety, and uncertainty. ISO examples include partial or complete interruption of core services, minor or large disclosure of sensitive information, system destruction, network failure, physical damage, infrastructure failure, malware, technical attack, rule breach, and compromise of information.

Keep category, severity, urgency, and notification analysis distinct. Severity expresses impact under the organization's scale; priority also reflects time and response needs. A statutory or contractual reporting threshold must be assessed against its own wording.

Define each level with observable impact or consequence criteria, examples, required response roles, authority, target times, communication route, escalation trigger, and exit criteria. Avoid labels such as low, medium, and high without tests that different assessors can apply consistently. ISO/IEC 27035-3 includes an informative four-level example, but its names and thresholds are not mandatory and should not be copied without adapting them to the organization's services and risk.

For each case, retain the initial rating, evidence used, uncertainty, assessor, time, and required actions. Add later ratings instead of overwriting the first one so the record shows how the incident evolved.

The incident coordinator should assess the event or incident against the approved scale and assign the initial rating, with input from affected business, asset, service, privacy, safety, and supplier owners as needed. The policy should identify who may confirm, raise, or lower each level.

The rating should activate response resources and authority, not wait for a committee. Decisions outside delegated authority, including crisis activation or material business interruption, should follow the escalation path.

Reassess after analysis, containment attempts, discovery of additional affected systems or people, recovery setbacks, supplier updates, or a change in legal or contractual notification analysis. Review at the frequency set for the current level and whenever the incident leaves its defined criteria.

A lower rating should follow evidence that impact and uncertainty have reduced, not only elapsed time. Record the new rating, time, facts, decision maker, and changes to resources, communications, or targets.

ISO/IEC 27035-1:2023 supplies the generic process and roles. ISO/IEC 27035-2:2023 covers planning for categorization, evaluation, prioritization, forms, escalation, and response capability. ISO/IEC 27035-3:2020 covers operational triage and gives informative examples based on incident type, impact, information or system importance, damage scale, alarm level and severity, organizational spread, and financial loss. The examples illustrate a method and do not create a universal scoring formula.

The series is voluntary global guidance for organizations of any type, size, or nature. It does not create a certification class, legal incident category, regulator threshold, notification deadline, recovery objective, or service-level target. Apply binding laws, regulator rules, contracts, insurance terms, safety duties, and customer commitments against their own wording even when the internal severity stays unchanged.