--- title: "ISO/IEC 27035 vs ISO 22301 Comparison" canonical_url: "https://www.sorena.io/artifacts/global/iso-27035/iso-27035-vs-iso-22301" source_url: "https://www.sorena.io/artifacts/global/iso-27035/iso-27035-vs-iso-22301" author: "Sorena AI" description: "ISO/IEC 27035 vs ISO 22301 for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance." published_at: "2026-05-09" updated_at: "2026-05-09" keywords: - "ISO/IEC 27035 vs ISO 22301" - "ISO/IEC 27035" - "ISO/IEC 27035 Information Security Incident Management" - "ISO/IEC 27035 vs ISO 22301 checklist" - "ISO/IEC 27035 vs ISO 22301 evidence" - "ISO/IEC 27035 vs ISO 22301 implementation" - "global compliance" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # ISO/IEC 27035 vs ISO 22301 Comparison ISO/IEC 27035 vs ISO 22301 for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. *ISO/IEC 27035 vs ISO 22301 side-by-side* *Global* *ISO/IEC 27035* ## ISO/IEC 27035 ISO/IEC 27035 vs ISO 22301 ISO/IEC 27035 vs ISO 22301 should help teams make a decision, assign owners, and collect evidence under ISO/IEC 27035 Information Security Incident Management. Grounded in external ISO, NIST, EU, or framework sources where relevant. This is practical implementation guidance, supporting implementation planning and should be validated against jurisdiction-specific legal, contractual, and policy requirements before implementation. This page on ISO/IEC 27035 vs ISO 22301 defines trigger and scope boundaries, assign accountable owners, identify required evidence, and define review rules for scope or risk changes. ## ISO/IEC 27035 vs ISO 22301: scope, duties, evidence, and decision rule Use this comparison to decide when ISO/IEC 27035 is the right operating model, when ISO 22301 controls the analysis, and how to reuse evidence without mixing sources. - **ISO/IEC 27035**: ISO/IEC 27035 is the primary scoping column: use it to confirm covered facts, accountable owners, mandatory artifacts, timing, and enforcement exposure before assigning implementation work. - **ISO 22301**: ISO 22301 is the second workstream in this comparison. Use it to test where the comparator has different scope, owners, triggers, evidence, timing, enforcement, and reuse limits from ISO/IEC 27035. | Dimension | ISO/IEC 27035 | ISO 22301 | Operational implication | Sources | | --- | --- | --- | --- | --- | | Scope and covered activity | ISO/IEC 27035 structures information security incident management from preparation and detection through response and lessons learned. | ISO 22301 is a certifiable BCMS requirements standard for continuity scope, BIA, strategies, plans, exercises, monitoring, audit, and improvement. | Write the scope memo so teams can see when ISO/IEC 27035 is the implementation structure, when ISO 22301 controls the obligation or assurance question, and where evidence can be reused without changing the source test. | [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process.
[ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. | | Who must act | ISO/IEC 27035 ownership should sit with the team that can operate the relevant management system, control process, risk method, supplier relationship, incident process, privacy process, or AI governance scope. | ISO 22301 ownership should sit with BCMS-specific roles such as executive sponsor, business continuity manager, process owner, crisis-management lead, recovery-plan owner, internal auditor, and management-review approver. | Do not copy owners from one side to the other; map accountable owners, reviewers, and approvers separately. | [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process.
[ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. | | Trigger or threshold | ISO/IEC 27035 work starts when an incident, control gap, supplier change, certification readiness check, or management review creates a need for incident-management action. | ISO 22301 work starts when continuity scope, a business impact analysis, recovery strategy, exercise, or plan needs to be defined, tested, or updated. | Use the trigger to route intake: incident-management work to the left, continuity-planning work to the right, and separate any shared evidence only after the owner, scope, and date line up. | [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process.
[ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. | | Core obligations | ISO/IEC 27035 requires practical governance: scope, roles, risk or impact decisions, evidence, operating cadence, monitoring, review, and improvement. | ISO 22301 expects its own required or recommended outcomes, which may include legal duties, assurance criteria, control objectives, profiles, or risk methodology. | Translate both sides into a single task register only after labeling which requirement or guidance source each task satisfies. | [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process.
[ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. | | Evidence and records | ISO/IEC 27035 evidence should show the process operating: owners, decisions, registers, control records, test results, review minutes, audit samples, or corrective actions. | ISO 22301 evidence should match its own proof model, such as regulatory records, attestation evidence, framework profiles, risk analysis, or contractual assurance. | Build an evidence matrix with one row per claim and columns for source, owner, artifact, date, review trigger, and reuse permission. | [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process.
[ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. | | Timing and cadence | ISO/IEC 27035 timing follows implementation, audit, certification, review, supplier, incident, or change cycles rather than a single universal deadline. | ISO 22301 timing follows the legal effective date, assurance period, framework version, contract milestone, or publication lifecycle that applies to that side. | Track dates separately so an ISO review cycle does not get mistaken for a statutory deadline or assurance reporting period. | [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process.
[ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. | | Enforcement or assurance route | ISO/IEC 27035 is usually tested through certification audits, internal audits, customer assurance, management review, or governance review, depending on how the organization adopts it. | ISO 22301 may be enforced, audited, attested, assessed, or used voluntarily depending on whether it is law, assurance criteria, a framework, or guidance. | Separate audit readiness from legal compliance and from voluntary framework maturity so executives see the actual consequence of gaps. | [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process.
[ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. | | Overlap and reuse | ISO/IEC 27035 can supply reusable management-system evidence, control operation records, risk decisions, and review outputs. | ISO 22301 can reuse some of that evidence when the control, process, risk, or duty is genuinely the same. | Reuse evidence only after checking scope, actor, date, data type, service, supplier, and acceptance criteria; otherwise keep separate records. | [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process.
[ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. | | Practical decision rule | Use ISO/IEC 27035 when the main work is building, operating, reviewing, or proving a management-system or standards-based control process. | Use ISO 22301 when the main work is satisfying that side's law, assurance route, framework outcome, risk method, or external reporting expectation. | If both apply, keep the primary obligation visible and use the other side as supporting structure, not as a substitute source. | [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process.
[ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. | Sources for Scope and covered activity - ISO/IEC 27035: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" Sources for Scope and covered activity - ISO 22301: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Scope and covered activity - operational implication: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Who must act - ISO/IEC 27035: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" Sources for Who must act - ISO 22301: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Who must act - operational implication: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Trigger or threshold - ISO/IEC 27035: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" Sources for Trigger or threshold - ISO 22301: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Trigger or threshold - operational implication: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Core obligations - ISO/IEC 27035: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" Sources for Core obligations - ISO 22301: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Core obligations - operational implication: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Evidence and records - ISO/IEC 27035: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" Sources for Evidence and records - ISO 22301: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Evidence and records - operational implication: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Timing and cadence - ISO/IEC 27035: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" Sources for Timing and cadence - ISO 22301: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Timing and cadence - operational implication: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Enforcement or assurance route - ISO/IEC 27035: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" Sources for Enforcement or assurance route - ISO 22301: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Enforcement or assurance route - operational implication: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Overlap and reuse - ISO/IEC 27035: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" Sources for Overlap and reuse - ISO 22301: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Overlap and reuse - operational implication: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Practical decision rule - ISO/IEC 27035: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" Sources for Practical decision rule - ISO 22301: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" Sources for Practical decision rule - operational implication: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" ### How should teams decide between ISO/IEC 27035 and ISO 22301 for compliance planning? - Start with the trigger: certification, risk review, cloud/customer assurance, incident, supplier, privacy, AI governance, law, or framework mapping. - Identify the binding or chosen source for each claim before assigning controls or collecting evidence. - Reuse evidence only where the same owner, scope, time period, system, supplier, data type, and acceptance criteria apply. Sources for the practical decision rule: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" ## What decision should teams make about ISO/IEC 27035 vs ISO 22301 under ISO/IEC 27035 Information Security Incident Management? For ISO/IEC 27035, the useful record is practical: decision, scope, owner, evidence, exception, review trigger, and next action. The first decision is whether ISO/IEC 27035 vs ISO 22301 changes scope, risk, control selection, evidence, certification readiness, customer commitments, or regulatory mapping. If it does, treat it as an accountable management-system decision rather than a side note. ISO/IEC 27035 is useful when it turns broad intent into repeatable work: turn incident handling into a prepared, measurable, evidence-backed process from detection through lessons learned, with ownership, evidence, and review cadence recorded alongside the definition. - Define the scope for ISO/IEC 27035 vs ISO 22301 before assigning controls or requesting evidence. - Tie each claim to a decision record, an owner, and current evidence rather than a policy label alone. - Review the record whenever during each incident, after exercises, after major control or threat changes, and during lessons-learned and management-review cycles. Sources for this answer: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - [ISO/IEC 27035-2:2023 standard page](https://www.iso.org/standard/78974.html?ref=sorena.io) - Primary ISO listing for planning, preparing, and lessons-learned guidance. ## Which records should prove ISO/IEC 27035 vs ISO 22301 is implemented correctly? Evidence should be collected where the work actually happens. For ISO/IEC 27035, that usually means incident policy, incident response plan, IMT/IRT roles, severity matrix, event triage records, escalation logs, notification evidence, containment and recovery records, lessons learned, and retained logs. A strong evidence set tells a visitor, auditor, customer, or decision owner what was decided, why it was reasonable, who approved it, and when it must be reviewed again. - Artifact-specific evidence: incident policy, response plan, severity matrix, triage records, escalation logs, notifications, containment and recovery notes, lessons learned, and retained logs. - Decision record: scope, assumption, risk or obligation, owner, approval, and date. - Operation record: ticket, log, review, test, contract clause, register entry, or control sample showing the process ran. - Review record: result, exception, corrective action, next owner, and next review date. Sources for this answer: - [ISO/IEC 27035-2:2023 standard page](https://www.iso.org/standard/78974.html?ref=sorena.io) - Primary ISO listing for planning, preparing, and lessons-learned guidance. - [ISO/IEC 27035-3:2020 standard page](https://www.iso.org/standard/74033.html?ref=sorena.io) - Primary ISO listing for ICT incident response operations guidance. ## How should teams turn ISO/IEC 27035 vs ISO 22301 into a repeatable workflow? Build the workflow around a small number of durable checkpoints: intake, classification, owner assignment, evidence request, decision, review, and escalation. This keeps the work usable across audits, customer assurance, and operational reviews. Avoid overfitting the workflow to one audit cycle. The same record should help during normal operations, change review, incident response, supplier review, or management review depending on the topic. - Intake: describe the system, service, supplier, control, incident, AI system, or process affected. - Classification: decide whether this is scope, risk, treatment, evidence, contract, incident, privacy, continuity, or AI governance work. - Escalation: route exceptions to the person or forum that can accept risk or fund remediation. Sources for this answer: - [ISO/IEC 27035-3:2020 standard page](https://www.iso.org/standard/74033.html?ref=sorena.io) - Primary ISO listing for ICT incident response operations guidance. - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. *Recommended next step* *Placement: after implementation guidance* ## Operationalize ISO/IEC 27035 vs ISO 22301 This page moves ISO/IEC 27035 guidance into an auditable operating loop with owners, evidence requests, decision records, and scheduled review dates. - [Open Assessment Autopilot for ISO/IEC 27035](/solutions/assessment.md): Convert ISO/IEC 27035 vs ISO 22301 into accountable tasks, evidence requests, and review checkpoints. - [Talk through implementation](/contact.md): Review your current scope, evidence gaps, and next implementation steps. ## What mistakes make ISO/IEC 27035 vs ISO 22301 weak or hard to audit? The common failure is writing generic compliance copy that cannot be connected to a real owner, system, supplier, recovery target, control sample, risk decision, or AI use case. That makes the page look complete but leaves no proof when someone asks how it works. Another failure is mixing standards and regulations without stating which source creates the requirement. Use ISO standards to structure management-system practice, and use legal sources separately when a binding obligation applies. - Do not cite a standard title as evidence that a process is operating. - Do not reuse an old audit artifact after the scope, service, supplier, or risk has changed. - Do not hide exceptions; record them as risk acceptance, corrective action, or management-review inputs. Sources for this answer: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. ## How should teams review and improve ISO/IEC 27035 vs ISO 22301 over time? Review should happen during each incident, after exercises, after major control or threat changes, and during lessons-learned and management-review cycles. If the review changes the decision, update the register, workflow, control evidence, or contract record that downstream teams rely on. Improvement is strongest when the same evidence supports multiple needs: certification audits, customer assurance, regulatory mapping, supplier governance, incident reviews, and management review. - Set a review date and a change-trigger rule. - Track findings until closure and connect them to corrective actions or risk acceptance. - Use management review to decide resourcing, risk appetite, scope changes, and evidence quality. Sources for this answer: - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - [ISO/IEC 27035-2:2023 standard page](https://www.iso.org/standard/78974.html?ref=sorena.io) - Primary ISO listing for planning, preparing, and lessons-learned guidance. ## Primary sources - [ISO/IEC 27035-1:2023 standard page](https://www.iso.org/standard/78973.html?ref=sorena.io) - Primary ISO listing for incident management principles and process. - Quote: "preparing for, detecting, reporting, assessing, and responding to incidents" - [ISO/IEC 27035-2:2023 standard page](https://www.iso.org/standard/78974.html?ref=sorena.io) - Primary ISO listing for planning, preparing, and lessons-learned guidance. - Quote: "plan and prepare for incident response and to learn lessons" - [ISO/IEC 27035-3:2020 standard page](https://www.iso.org/standard/74033.html?ref=sorena.io) - Primary ISO listing for ICT incident response operations guidance. - Quote: "information security incident response in ICT security operations" - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the current ISO 22301 business continuity management system requirements standard. - Quote: "Business continuity management systems - Requirements" ## Related Topic Guides - [ISO/IEC 27035 Compliance Guide](/artifacts/global/iso-27035/compliance.md): ISO/IEC 27035 Compliance for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 CSIRT Roles FAQ](/artifacts/global/iso-27035/faq/csirt-roles.md): How should teams handle CSIRT Roles under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Escalation FAQ](/artifacts/global/iso-27035/faq/escalation.md): How should teams handle Escalation under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Event vs Incident FAQ](/artifacts/global/iso-27035/faq/event-vs-incident.md): How should teams distinguish a security event from an information security incident under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Evidence Log Template and Workflow](/artifacts/global/iso-27035/evidence-log-template.md): ISO/IEC 27035 Evidence Log Template for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Incident Lifecycle Guide](/artifacts/global/iso-27035/incident-lifecycle.md): ISO/IEC 27035 Incident Lifecycle for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Incident Lifecycle Workflow](/artifacts/global/iso-27035/incident-lifecycle-workflow.md): ISO/IEC 27035 Incident Lifecycle Workflow for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Incident Management FAQ](/artifacts/global/iso-27035/faq.md): ISO/IEC 27035 FAQ for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Incident Response Playbook](/artifacts/global/iso-27035/incident-response-playbook.md): ISO/IEC 27035 Incident Response Playbook for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Incident Severity and Escalation Matrix](/artifacts/global/iso-27035/incident-severity-and-escalation-matrix.md): ISO/IEC 27035 Incident Severity and Escalation Matrix for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Incident Timer Workflow Template and Workflow](/artifacts/global/iso-27035/incident-timer-workflow.md): ISO/IEC 27035 Incident Timer Workflow for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Lessons Learned FAQ](/artifacts/global/iso-27035/faq/lessons-learned.md): How should teams handle Lessons Learned under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Notification Evidence FAQ](/artifacts/global/iso-27035/faq/notification-evidence.md): How should teams handle Notification Evidence under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Notification Threshold Mapping Guide](/artifacts/global/iso-27035/notification-threshold-mapping.md): ISO/IEC 27035 Notification Threshold Mapping for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 Post Incident Review FAQ](/artifacts/global/iso-27035/faq/post-incident-review.md): How should teams handle Post Incident Review under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Retained Logs FAQ](/artifacts/global/iso-27035/faq/retained-logs.md): How should teams handle Retained Logs under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Severity Classification FAQ](/artifacts/global/iso-27035/faq/severity-classification.md): How should teams handle Severity Classification under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 vs NIS2 Comparison](/artifacts/global/iso-27035/iso-27035-vs-nis2.md): ISO/IEC 27035 vs NIS2 for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 vs NIST SP 800-61 Comparison](/artifacts/global/iso-27035/iso-27035-vs-nist-800-61.md): ISO/IEC 27035 vs NIST SP 800-61 for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. - [ISO/IEC 27035 vs NIST SP 800-61 Rev. 3 Comparison](/artifacts/global/iso-27035/iso-27035-vs-nist-800-61r3.md): ISO/IEC 27035 vs NIST SP 800-61 Rev. 3 for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and source-linked implementation guidance. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/global/iso-27035/iso-27035-vs-iso-22301