ISO 27001 Annex A 5.24 Information security incident management planning and preparation

This control is broader than A.8.4.

Annex A 8.4 requires the organisation to determine and document a plan for communicating incidents to users of the AI system. Annex A 5.24 requires planning and preparation for managing information security incidents by defining and communicating incident management processes, roles and responsibilities, which typically includes communication and notification procedures. Annex A 5.24 is broader because it covers the full incident management lifecycle and governance, while Annex A 8.4 focuses specifically on user communications for AI system incidents.

This control partially overlaps A.3.2.

Annex A 3.2 requires defining and allocating AI roles and responsibilities. Annex A 5.24 (ISO/IEC 27001:2022) requires planning and preparing for incident management by defining and communicating roles and responsibilities. Both involve role assignment but Annex A 5.24 focuses on incident management, while Annex A 3.2 covers broader AI governance.

This control is broader than E8-AH-ML2.16.

E8-AH-ML2.16 requires prompt reporting of cyber security incidents to the CISO (or delegate). ISO/IEC 27001:2022 Annex A 5.24 requires planning and preparation for incident management, including defining and communicating roles, responsibilities and processes. E8-AH-ML2.16 is a specific role-based reporting requirement that sits within the broader incident management framework required by Annex A 5.24.

This control is broader than E8-AH-ML2.18.

Annex A 5.24 requires the organisation to plan and prepare for information security incident management by defining, establishing and communicating incident processes, roles and responsibilities. E8-AH-ML2.18 focuses on one operational step: enacting the incident response plan once an incident is identified, which relies on that prior planning and role clarity. Annex A 5.24 is broader because it covers preparation activities (process definition, communication, role assignment) beyond the single trigger-to-action requirement.

This control is broader than E8-MF-ML2.11.

E8-MF-ML2.11 requires timely reporting of cyber security incidents to ASD after occurrence or discovery. Annex A 5.24 is broader because it requires planning and preparation for incident management processes, roles and responsibilities, within which external reporting (including to ASD) would be defined. E8-MF-ML2.11 is a specific reporting requirement that would be implemented as part of the broader incident management framework in Annex A 5.24.

This control is broader than E8-RA-ML2.11.

ISO/IEC 27001:2022 Annex A 5.24 requires planning and preparation for incident management by defining and communicating processes, roles, and responsibilities. E8-RA-ML2.11 requires prompt reporting of cyber security incidents to the CISO (or delegate). The primary control is a specific escalation requirement that would normally sit within the broader incident management framework established under Annex A 5.24.

This control supports E8-AC-ML2.11.

E8-AC-ML2.11 requires activating the incident response plan once an incident is identified. Annex A 5.24 requires planning and preparation for incident management by defining, establishing and communicating processes, roles and responsibilities. E8-AC-ML2.11 depends on Annex A 5.24 because plan enactment relies on pre-defined processes and roles being established and communicated beforehand.

This control supports E8-MF-ML2.12.

E8-MF-ML2.12 requires the organisation to enact its incident response plan once a cyber incident is identified. Annex A 5.24 requires planning and preparation for incident management by defining processes, roles and responsibilities, which is foundational to having an enactable plan. In practice, E8-MF-ML2.12 relies on the preparatory activities in Annex A 5.24 to ensure activation is actionable and properly owned.

This control supports E8-RA-ML2.12.

E8-RA-ML2.12 requires organisations to report cyber security incidents to ASD as soon as possible after discovery. Annex A 5.24 requires planning and preparation for incident management by defining processes, roles, and responsibilities, which are prerequisites for timely external notification. Annex A 5.24 is broader readiness and operating model, while E8-RA-ML2.12 is a specific external reporting outcome to ASD.

This control supports E8-RA-ML2.13.

E8-RA-ML2.13 requires enacting the incident response plan once an incident is identified. Annex A 5.24 requires planning and preparation for incident management by defining and communicating processes, roles and responsibilities, which underpins the ability to enact the plan effectively.

This control is broader than ISM-0123.

ISM-0123 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after they occur or are discovered. Annex A 5.24 is broader because it requires planning and preparation for incident management by defining and communicating processes, roles and responsibilities, within which reporting and escalation to the CISO would sit. ISM-0123 is a specific reporting requirement that would form part of the wider incident management framework required by Annex A 5.24.

This control is broader than ISM-0125.

ISM-0125 requires an organisation to develop, implement and maintain a cyber security incident register to record incidents. ISO/IEC 27001:2022 Annex A 5.24 requires broader incident management planning and preparation, including defining processes, roles, and responsibilities for managing incidents. ISM-0125 is a specific artefact/control within that broader incident management capability rather than covering all planning and preparation elements.

This control is broader than ISM-0137.

ISM-0137 requires legal advice to be sought before choosing to let intrusion activity continue to collect further data or evidence. This supports Annex A 5.24 because incident management planning should define roles, responsibilities and escalation pathways (including legal counsel engagement) for such high-risk decisions. Annex A 5.24 is broader planning and preparedness, while ISM-0137 is a specific operational decision control during an incident.

This control is broader than ISM-1019.

ISM-1019 requires a maintained DoS response plan for specific services to handle availability disruptions. Annex A 5.24 covers broader incident management processes, under which a DoS response plan would sit as a playbook. ISM-1019 is narrower as it is service- and threat-specific.

This control is broader than ISM-1731.

ISM-1731 requires organisations to coordinate intrusion remediation from a separate system than the one compromised, addressing integrity and trust in incident response operations. Annex A 5.24 requires the organisation to plan and prepare incident management processes, roles and responsibilities, within which using separate systems for remediation coordination is a practical control implementation. Annex A 5.24 is broader planning/governance for incident management, while ISM-1731 is a specific operational requirement about the tooling/environment used during remediation.

This control is broader than ISM-1819.

Annex A 5.24 requires the organisation to plan and prepare for information security incidents by establishing and communicating incident management processes and assigning roles and responsibilities. ISM-1819 requires that, once a cyber security incident is identified, the cyber security incident response plan is enacted. ISM-1819 is a subset execution requirement, while Annex A 5.24 covers the upstream planning and preparedness needed to make enactment effective.

This control partially meets ISM-1088.

ISM-1088 requires personnel to report potential compromises of mobile devices, removable media or credentials quickly, especially when overseas indicators of compromise arise. ISO/IEC 27001:2022 Annex A 5.24 requires the organisation to plan and prepare incident management by defining processes, roles and responsibilities and communicating them. ISM-1088 is one specific behavioural/procedural reporting requirement that would sit within an Annex A 5.24 incident management framework, but it does not cover the full planning and preparedness scope.

This control partially overlaps ISM-0043.

ISM-0043 requires systems to have a cyber security incident response plan covering definitions, incident types and responses, reporting (internal/external), authorities, escalation to law enforcement/ASD, evidence integrity, and contingency measures. ISO/IEC 27001:2022 Annex A 5.24 relates by requiring incident management planning and preparation through defined processes, roles and responsibilities that underpin an incident response plan. ISM-0043 is more prescriptive about plan contents (evidence handling, external reporting criteria, and contingency measures), while Annex A 5.24 is broader process governance without specifying those detailed inclusions.

This control partially overlaps ISM-0714.

Annex A 5.24 requires planning and preparation for incident management, including defining roles and responsibilities. ISM-0714 relates by requiring appointment of a CISO to provide cyber security leadership and guidance, which contributes to having accountable roles for incident management planning and coordination. ISM-0714 is broader organisational leadership/governance and not incident-management-specific, while Annex A 5.24 is specifically about incident management planning and preparation.

This control partially overlaps ISM-0733.

Annex A 5.24 requires the organisation to define and communicate incident management processes and roles to be prepared to manage incidents. ISM-0733 relates by ensuring the CISO is fully aware of all cyber security incidents, which supports effective incident coordination and role fulfilment within those processes. ISM-0733 is more specific to situational awareness and reporting to a single role, whereas Annex A 5.24 covers the full planning and preparation of incident management across the organisation.

This control partially overlaps ISM-1576.

ISM-1576 requires that an organisation be immediately notified when a service provider performs unauthorised access or administration of the organisation's systems. Annex A 5.24 requires planning and preparation for information security incident management processes, roles and responsibilities, which includes how notifications from third parties are received, triaged and acted upon. Annex A 5.24 is broader (end-to-end incident management), whereas ISM-1576 is a specific third-party notification obligation.

This control partially overlaps ISM-1618.

ISM-1618 requires that the CISO oversees the organisation's response to cyber security incidents. Annex A 5.24 requires the organisation to plan and prepare incident management by defining and communicating processes, roles and responsibilities, aligning with the CISO's oversight role. The ISO control is broader, covering all incident management governance, whereas ISM-1618 is specific to the CISO's leadership role.

This control partially overlaps ISM-1784.

Annex A 5.24 requires organisations to plan and prepare for managing information security incidents through defined, established, and communicated processes, roles and responsibilities. ISM-1784 relates by requiring the incident management policy and response plan to be exercised at least annually, which is a key preparedness activity. Annex A 5.24 does not explicitly mandate testing frequency, while ISM-1784 is specifically about exercising/testing rather than the broader design and communication of the incident management framework.

This control partially overlaps ISM-1997.

ISM-1997 requires the board or executive committee to define clear cyber security roles and responsibilities across the organisation. Annex A 5.24 requires defining and communicating incident management processes, roles and responsibilities for handling information security incidents. They overlap on the need to define and communicate roles, but Annex A 5.24 is limited to incident management whereas ISM-1997 covers cyber security leadership roles more broadly.

This control partially overlaps ISM-2006.

ISM-2006 requires the board/executive committee to plan and practise for major cyber security incidents (e.g. participate in exercises) and understand their duties. Annex A 5.24 requires the organisation to plan and prepare incident management processes, including defining roles and responsibilities and communicating them. They overlap on incident preparedness and clarifying responsibilities, but ISM-2006 is explicitly executive-governance focused and exercise participation, whereas Annex A 5.24 is broader across the whole incident management framework and operational roles.

This control supports ISM-1881.

ISM-1881 requires timely reporting to customers and the public about cyber incidents that do not involve customer data. Annex A 5.24 requires planning and preparation for incident management, including defining and communicating processes, roles and responsibilities, which is a prerequisite to executing timely external communications. The ISO control is broader incident-management governance and does not explicitly require customer/public reporting.

This control is broader than IT.RES-05.1.

IT.RES-05.1 requires external coordination obligations to be integrated into cyber security incident response activities where required. This is a specific element of the incident management processes, roles and responsibilities that Annex A 5.24 requires the organisation to define, establish and communicate when planning and preparing for incidents. Annex A 5.24 covers incident management planning as a whole, while IT.RES-05.1 addresses only external coordination.

This control partially overlaps IT.RES-03.1.

IT.RES-03.1 requires documented, tested and approved cyber security incident response procedures to be used when responding to cyber security incidents. It shares common ground with Annex A 5.24, which requires incident management processes, roles and responsibilities to be defined, established and communicated in advance, since the procedures must exist before they can be used. IT.RES-03.1 adds testing, approval and use of the procedures during response, while Annex A 5.24 also covers roles, responsibilities and communication of the processes.

This control partially overlaps IT.RES-04.2.

IT.RES-04.2 requires monitoring coverage and cyber security incident response procedures to be evaluated following cyber security incidents. Evaluating the response procedures after each incident strengthens the incident management processes that Annex A 5.24 requires the organisation to define, establish and communicate in advance. Annex A 5.24 covers planning and preparation, including roles and responsibilities, while IT.RES-04.2 is a post-incident evaluation that also extends to monitoring coverage.