ISO/IEC 27035 Notification Threshold Mapping

ISO/IEC 27035 has three parts with different jobs. Part 1:2023 covers the principles and five-phase process for information security incidents, including incidents that do not involve information and communication technology. Part 2:2023 covers planning and preparation. Part 3:2020 covers ICT incident response operations only, including notification and internal and external reporting. Use the Part 3 reporting model for ICT incidents without extending its operational scope to non-ICT cases.

Create one row for each distinct reporting route. Record the controlling law, regulation, authority instruction, contract, insurance term, policy, or voluntary arrangement; the covered entity, jurisdiction, service, data, and incident type; the trigger test; the event that starts the clock; the decision owner; deadline; recipient; channel; required content; approval; update or final-report duties; confidentiality limits; and proof of submission.

Keep three decisions separate. Event notification sends a suspected event to the point of contact. Internal incident reporting informs the response team, management, and other assigned functions. External reporting sends information outside the organization when a controlling source or an authorized voluntary decision requires it. One incident can follow several routes with different definitions and clocks.

Start the notification review when the facts could meet a mapped trigger, not only after the incident receives its final severity. Link the decision to the incident identifier and preserve the source version, covered entity and service, known facts, missing facts, trigger analysis, clock start, deadline, owner, approver, decision time, and next reassessment.

For a submitted report, retain the approved content, recipient, channel, transmission time, acknowledgement or case number, later updates, and final report where required. Protect sensitive content under the applicable handling rules. For a no-report decision, retain the reason and the fact or time that will reopen the analysis.

At intake, record when the organization received the event and notify the incident coordinator. During assessment, identify the affected entities, services, systems, data, jurisdictions, contracts, and parties, then open every potentially relevant threshold row. The assigned owner decides each route against its own source and clock while the response team continues to contain and recover.

If the source permits or requires staged reporting, send the required initial information by the applicable deadline and update it through the defined route. Do not delay an initial report solely because cause, scope, or affected numbers remain uncertain unless the controlling source allows that delay. Correct material errors through the same approved process and keep the earlier submission.

Severity, external reportability, and urgency are related but separate. A low operational severity can still meet a legal or contractual trigger, while a critical incident may fall outside a particular reporting regime. Evaluate every mapped row independently and record how the incident facts meet or fail its test.

The reporter may also differ by route. The ICT response team can supply technical facts, but legal, privacy, regulatory, customer, supplier, insurer, law-enforcement, or public communications may belong to another authorized role. The map should name both the fact provider and the person allowed to decide or send.

Assign an owner and review date to every row. Review sooner when a law, authority instruction, contract, insurance term, service, legal entity, jurisdiction, supplier, customer, reporting portal, contact, or internal authority changes. Archive superseded rows so past decisions can be evaluated against the source in force at the time.

Exercise cases with overlapping routes, uncertain clock starts, incomplete facts, out-of-hours approval, unavailable portals, confidential evidence, and later corrections. Measure whether the team identified every relevant route, reached the correct owner, sent the required content through the proper channel, and retained proof.