ISO/IEC 27035 FAQ Lessons Learned

Analyse patterns across events and incidents as well as the individual case. Identify improvements to the incident plan, incident management team and incident response team performance, security controls, risk assessment, management review inputs, awareness, training, external relationships, tools, and metrics.

Prioritize improvements by risk, recurrence, and feasibility. A recommendation remains open until an accountable owner implements it and verifies effectiveness, or an authorized decision maker records why it was rejected, deferred, or accepted as residual risk, meaning the risk that remains after current controls and the approved decision.

Link each lesson to the incident report, timeline, exercise observation, vulnerability, metric, or repeated event pattern that supports it. Keep the proposed change, affected control or plan element, risk, owner, priority, due date, dependency, approval, implementation evidence, and effectiveness result.

Preserve decisions not to act. The record should identify the decision authority, rationale, residual risk, review trigger, and any compensating action instead of making the recommendation disappear.

The incident coordinator and incident management team should assemble the evidence and propose improvements. The owner who controls the affected system, process, supplier, control, budget, or policy should accept the action; the relevant risk or management authority should approve rejection, deferral, or residual risk.

Include affected responders and business owners when validating the finding. Legal, privacy, human resources, communications, safety, continuity, or supplier owners should join only when the lesson falls within their responsibility.

Begin after the incident is resolved and enough evidence is stable for useful analysis. Do not wait for one large incident: ISO/IEC 27035 also supports learning from multiple incidents, reported vulnerabilities, exercises, and performance data.

Review open actions at planned intervals and when their assumptions, risk, owner, dependency, or target system changes. Close an action only after checking the agreed acceptance criteria and recording the result.

ISO/IEC 27035-1:2023 makes learning lessons part of the generic incident-management process for organizations of any type, size, or nature. ISO/IEC 27035-2:2023 provides the detailed improvement activities: review the plan, evaluate team performance, improve control implementation, update risk assessment and management-review inputs, strengthen awareness and training, and improve relationships, tools, and metrics. ISO/IEC 27035-3:2020 supplies operational evidence from ICT response.

The standards do not prescribe a universal meeting deadline, review period, action due date, or closure threshold. The organization should set a cadence proportional to incident risk and capability needs. A severe or novel incident can justify an immediate review; recurring low-impact events can be aggregated; urgent containment and control fixes should proceed without waiting for the full lessons cycle.