ISO/IEC 27035 FAQ Notification Evidence

Keep the controlling law, contract, policy, or authority instruction beside the decision record. Record the covered entity or service, jurisdiction, incident category, threshold analysis, facts known at the time, when any reporting clock began, decision owner, approver, recipients, submission channel, content and attachments sent, delivery evidence, acknowledgement, and required updates or final reports. A point of contact can receive the report, but the notification matrix should identify who has authority to decide and submit each external notice.

Preserve decisions not to notify. The record should identify the threshold applied, facts and uncertainty considered, legal or contractual review where needed, approval, and the change in facts that would trigger reassessment. ISO/IEC 27035 organizes this work but does not supply the external deadline or reporting threshold.

Test the notification procedure in exercises and sample completed incidents. A reviewer should be able to trace the alert or incident through threshold assessment, approval, submission, acknowledgement, follow-up, and closure without reconstructing the record from personal mailboxes.

Maintain a notification matrix by jurisdiction, entity, service, incident type, recipient, threshold, clock-start rule, channel, required content, approver, update cadence, and evidence location. Legal or regulatory owners should verify entries when the controlling source changes.

The incident coordinator should assemble the operational facts and keep the record moving. The person authorized under the controlling law, contract, or policy should decide or approve the notification; that can involve legal, privacy, regulatory, customer, insurance, communications, or business leadership.

Predefine substitutes and emergency authority. Approval must not become an avoidable delay where a deadline applies, and the incident team should continue containment and evidence preservation while the notification decision is pending.

Reassess whenever new facts change the affected systems, people, geography, duration, impact, cause, or confidence in the original analysis. Also reassess when containment fails, a supplier supplies new facts, another authority becomes relevant, or the controlling rule requires an update or final report.

Do not silently replace the first decision. Add a timestamped decision showing what changed, which threshold was reconsidered, who approved the result, and whether another communication is due.

ISO/IEC 27035-1:2023 supplies the generic incident-management process and core roles. ISO/IEC 27035-2:2023 covers policy, plans, relationships, legal and regulatory considerations, recordkeeping, forms, exercises, and lessons learned. ISO/IEC 27035-3:2020 covers ICT notification, triage, internal reporting, external reporting where required, and report storage. These editions apply when the organization adopts or is contractually required to use them; the standards do not set a statutory commencement date.

No ISO/IEC 27035 part supplies one global threshold or deadline for external notice. The controlling jurisdiction, regulated entity or service, affected people, contract, insurer term, or authority instruction determines whether a report is required, when its clock starts, what it must contain, and whether interim, corrected, or final reports are due. Treat ISO as the operating framework and the external rule as the source of the duty.