ISO/IEC 27035 Incident Severity and Escalation Matrix

For incident work, decide the timer and escalation path before an event occurs: classification, severity, legal-notification review, containment owner, communications owner, recovery owner, and evidence custodian.

The matrix should start with triage and validation. NIST SP 800-61r3 says incident reports should be triaged and validated, then the incident should be categorized and prioritized based on its scope, likely impact, time-critical nature, and resource availability. It also says escalation or elevation is needed when more response resources or a change in management attention is required.

Use clear factors to set the severity level: asset criticality, functional impact, data impact, stage of observed activity, threat actor characterization, and recoverability. If the incident's severity changes, update the owner, response strategy, communications, and recovery timing accordingly.

Evidence should be collected where the work actually happens. For ISO/IEC 27035, that usually means incident policy, incident response plan, IMT/IRT roles, severity matrix, event triage records, escalation logs, notification evidence, containment and recovery records, lessons learned, and retained logs.

A strong evidence set tells a visitor, auditor, customer, or decision owner what was decided, why it was reasonable, who approved it, and when it must be reviewed again.

Build the workflow around a small number of durable checkpoints: intake, classification, owner assignment, evidence request, decision, review, and escalation. This keeps the work usable across audits, customer assurance, and operational reviews.

Avoid overfitting the workflow to one audit cycle. The same record should help during normal operations, change review, incident response, supplier review, or management review depending on the topic.

The common failure is writing generic compliance copy that cannot be connected to a real owner, system, supplier, recovery target, control sample, risk decision, or AI use case. That makes the page look complete but leaves no proof when someone asks how it works.

Another failure is mixing standards and regulations without stating which source creates the requirement. Use ISO standards to structure management-system practice, and use legal sources separately when a binding obligation applies.

Review should happen during each incident, after exercises, after major control or threat changes, and during lessons-learned and management-review cycles. If the review changes the decision, update the register, workflow, control evidence, or contract record that downstream teams rely on.

Improvement is strongest when the same evidence supports multiple needs: certification audits, customer assurance, regulatory mapping, supplier governance, incident reviews, and management review.