ISO/IEC 27035 Incident Timer Workflow

Preserve several timestamps rather than forcing one ambiguous start time: when the underlying event occurred or began, when a person or system detected it, when it was reported to the point of contact, when the report was validated, when the event was declared an incident, and when the organization reached any legally defined awareness threshold. Record the source, time zone, precision, and uncertainty for each timestamp.

Start operational targets at the point defined in the incident plan, such as validated report or incident declaration. Track validation, assessment, coordinator assignment, response-team activation, escalation, analysis, containment decision, containment result, recovery decision, recovery validation, communications, and conclusion as separate checkpoints. A missed target should trigger escalation and a recorded reason, not a rewritten start time.

Create one obligation entry for each possible recipient or commitment. Identify the legal instrument, regulator guidance, contract clause, policy, insurer condition, or service commitment that creates the clock. Record the covered entity or service, incident trigger, clock-start rule, deadline calculation, required content, update or final-report stages, responsible owner, and decision status.

The legal or contract owner should decide applicability using the current incident facts; the response team should supply and timestamp those facts. Record a reasoned not-applicable decision when a plausible obligation is reviewed but not triggered. If the trigger depends on facts still being investigated, set a reassessment time before the earliest possible deadline.

Reassess the clocks whenever new evidence changes incident classification, severity, affected services, affected jurisdictions or people, supplier involvement, data impact, or the organization's knowledge of the incident. Add the new fact, assessment time, decision owner, and revised calculation without deleting earlier entries.

A change does not automatically restart an existing deadline. The controlling source determines whether a new obligation, update, supplemental report, or revised calculation applies. If the rule is unclear, preserve the earliest plausible trigger and escalate the interpretation rather than waiting for certainty.

The timer should let a reviewer reconstruct what the organization knew, when it knew it, which rule or internal target was applied, who made the decision, and what happened next. Link every material timestamp to an alert, ticket, call record, system log, meeting record, submission receipt, or other source. Label estimated or reconstructed times.

Use synchronized clocks and a stated time zone where feasible, but do not discard a useful record because its clock differs. Preserve the original value, document the offset or uncertainty, and explain any normalized time used for the chronology.

Use exercises and incident reviews to test whether targets are realistic and whether contacts, approvals, evidence sources, and reporting channels work outside normal hours. Measure time to validate, declare, assign, escalate, contain, communicate, recover, and conclude by severity, but investigate the reasons behind delays before changing a target.

Update the timer rules when services, suppliers, contracts, jurisdictions, reporting systems, regulator guidance, or internal authority change. Keep change history and test a revised rule before relying on it.