What does ISO 27001 Annex A 5.25 require?

verifiedISO/IEC 27001:2022

ISO 27001 Annex A 5.25Assessment and decision on information security events

Official control statement

The organization shall assess information security events and decide if they are to be categorized as information security incidents.

verifiedISO/IEC 27001:2022Annex A 5.25

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Evaluate security events to determine which are serious enough to be called incidents.

Organisational controlsISO/IEC 27001:2022

Control Stack classificationDetective Incident detection and triage

record_voice_over

What this means in practice

This control is about figuring out if a security problem is just a minor hiccup or a real incident that needs immediate attention. If it's not done, small issues might be ignored until they grow into big, costly problems like data breaches.

01 - Overview

Framework

ISO/IEC 27001:2022

Control effect (Control Stack)

Detective

ISO 27001 domain

Organisational controls

Classifications

N/A

Official last update

24 Oct 2022

Control Stack last updated

29 Sept 2026

priority_high

Why it matters

If security events are not assessed and categorised promptly, true incidents may be missed, delaying containment and increasing business impact.

settings

Operational notes

Define event triage criteria and decision thresholds for incident categorisation; train responders and review samples to ensure consistent classification.

02 - Implement

build

Implementation tips

The IT Manager should lead the assessment of security events by using an agreed-upon checklist or guide. They can develop this checklist based on the organisation's policies and applicable standards such as ISO 27002:2022.
Designate a response team to decide which security events are incidents. Team members should meet regularly to review and discuss events, look for patterns, and apply criteria often outlined by Australian regulations like the Privacy Act 1988.
Provide training for staff to recognise potential security events. The training, run by HR or the IT team, should include examples of incidents and ensure staff know who to report issues to and how.
Ensure all IT systems log events automatically. The IT team should configure systems to generate logs that capture relevant details to help assess whether an event could be an incident, as guided by ISO 27002:2022.
Maintain a record of past incidents and how they were resolved. This should be done by the security team to refine the assessment process over time and meet any audit requirements, such as those from regulatory bodies like APRA under standard CPS 234.

03 - Audit

fact_check

Audit / evidence tips

AskThe organisation's incident response policyLook atWhether it includes criteria for defining and categorising incidents. GOOD policies will have clear definitions and a prioritisation process that aligns with industry standards such as ISO 27002:2022
AskTo see recent incident logs and reportsLook atThe details within these logs that show assessments were performedGoodReport will clearly distinguish between minor events and full incidents
AskHow staff are informed of the reporting processLook atTraining records or materialsGoodTraining program will have evidence of employee participation and understanding of event reporting procedures
AskEvidence of periodic reviews of the event assessment processLook atMeeting notes or review outcomes. GOOD evidence will show regular adjustments to criteria based on past incidents and lessons learned
AskExamples of past recorded incidentsLook atThe documentation for assessment and decision-making details. GOOD documentation will provide a transparent view of how decisions were made and why

04 - Mappings

link

Cross-framework mappings

How Annex A 5.25 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

E8

Control	Notes	Details
sync_altPartially overlaps(4)expand_less

E8-AC-ML2.8	E8-AC-ML2.8 requires timely analysis of cyber security events to identify cyber security incidents

E8-MF-ML2.9	E8-MF-ML2.9 requires timely analysis of cyber security events to identify cyber security incidents

E8-RA-ML2.10	E8-RA-ML2.10 requires timely analysis of cyber security events to identify incidents

E8-AH-ML2.15	E8-AH-ML2.15 requires cyber security events to be analysed in a timely manner so they can be identified and treated as incidents
handshakeSupports(2)expand_less

E8-MF-ML2.11	E8-MF-ML2.11 requires reporting cyber security incidents to ASD as soon as possible after occurrence or discovery
E8-MF-ML2.12	E8-MF-ML2.12 requires enacting the incident response plan after a cyber security incident is identified
extensionDepends on(4)expand_less

E8-AC-ML2.7	E8-AC-ML2.7 requires timely analysis of internet-facing server event logs to detect cyber security events

E8-MF-ML3.5	E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events

E8-AH-ML2.14	E8-AH-ML2.14 requires timely analysis of internet-facing server event logs to detect cyber security events
E8-AH-ML3.5	E8-AH-ML3.5 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events

ASD ISM

Control	Notes	Details
equalEquivalent(1)expand_less
ISM-1228	ISM-1228 requires cyber security events to be analysed in a timely manner to identify cyber security incidents
sync_altPartially overlaps(1)expand_less
ISM-2148	ISM-2148 requires revoking sessions and tokens when compromise is suspected, devices are non-compliant, or risky sign-ins are detected
handshakeSupports(1)expand_less
ISM-0043	Annex A 5.25 requires the organisation to assess information security events and decide whether they are incidents
extensionDepends on(2)expand_less
ISM-2116	ISM-2116 requires organisations to use cyber threat intelligence services to support detecting events and identifying incidents
ISM-2132	ISM-2132 requires central logging of certificate enrolment events and AD CS/template configuration changes to detect and investigate misuse