ISO 27001 Annex A 5.25 Assessment and decision on information security events

This control partially overlaps E8-AC-ML2.8.

E8-AC-ML2.8 requires timely analysis of cyber security events to identify cyber security incidents. Annex A 5.25 requires organisations to assess information security events and decide whether they should be categorised as incidents, which is the decision point that analysis feeds. Annex A 5.25 is more explicit about formal assessment and categorisation, while E8-AC-ML2.8 emphasises timeliness of analysis as the means to reach that identification outcome.

This control partially overlaps E8-AH-ML2.15.

E8-AH-ML2.15 requires cyber security events to be analysed in a timely manner so they can be identified and treated as incidents. ISO/IEC 27001:2022 Annex A 5.25 aligns by requiring assessment of information security events and an explicit decision on whether they are information security incidents. Annex A 5.25 focuses on the decision/classification process (triage and categorisation), while E8-AH-ML2.15 emphasises timeliness and operational analysis to find incidents from events.

This control partially overlaps E8-MF-ML2.9.

E8-MF-ML2.9 requires timely analysis of cyber security events to identify cyber security incidents. Annex A 5.25 requires assessing information security events and deciding whether they should be categorised as incidents, which directly aligns with the event-to-incident decision point implicit in E8-MF-ML2.9. Annex A 5.25 is more explicit about categorisation/decision governance, while E8-MF-ML2.9 emphasises timeliness of analysis as the driver for early identification.

This control partially overlaps E8-RA-ML2.10.

E8-RA-ML2.10 requires timely analysis of cyber security events to identify incidents. Annex A 5.25 requires an assessment and decision process to determine whether information security events are to be categorised as incidents, aligning closely with the event-to-incident decision aspect of E8-RA-ML2.10. Annex A 5.25 emphasises the formal decision/categorisation process, while E8-RA-ML2.10 emphasises timeliness of analysis and may not explicitly require a documented categorisation workflow.

This control supports E8-MF-ML2.11.

E8-MF-ML2.11 requires reporting cyber security incidents to ASD as soon as possible after occurrence or discovery. Annex A 5.25 relates as a prerequisite by requiring assessment of security events and a decision on whether they are incidents, which determines what should be reported externally. Annex A 5.25 is about classification/decision-making, while E8-MF-ML2.11 is about the external reporting action once an incident is identified.

This control supports E8-MF-ML2.12.

E8-MF-ML2.12 requires enacting the incident response plan after a cyber security incident is identified. ISO/IEC 27001:2022 Annex A 5.25 is a prerequisite because it requires assessing events and deciding whether they are incidents, which establishes the point at which the response plan should be activated. Annex A 5.25 is about classification/decision-making, while E8-MF-ML2.12 is about the subsequent activation of response actions.

This control depends on E8-AC-ML2.7.

E8-AC-ML2.7 requires timely analysis of internet-facing server event logs to detect cyber security events. Annex A 5.25 requires organisations to assess information security events and decide whether they constitute incidents. E8-AC-ML2.7 supports Annex A 5.25 by generating identified events and evidence through log analysis, but it does not itself define triage, categorisation, or decision-making processes.

This control depends on E8-AH-ML2.14.

E8-AH-ML2.14 requires timely analysis of internet-facing server event logs to detect cyber security events. ISO/IEC 27001:2022 Annex A 5.25 requires assessing information security events and deciding whether they should be categorised as incidents, which depends on having timely and accurate event information. E8-AH-ML2.14 supports Annex A 5.25 by producing analysed log evidence that feeds event triage and categorisation.

This control depends on E8-AH-ML3.5.

E8-AH-ML3.5 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. Annex A 5.25 requires assessment of information security events and categorising them as incidents, relying on credible detection inputs. E8-AH-ML3.5 supports Annex A 5.25 by providing timely, evidence-based event data.

This control depends on E8-MF-ML3.5.

E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. This supports Annex A 5.25 by providing the evidence (detected events from workstation logs) that the organisation can then assess and decide whether to categorise as an information security incident. Annex A 5.25 is about decision-making and classification, while E8-MF-ML3.5 is about the detection activity that feeds that process.

This control is equivalent to ISM-1228.

ISM-1228 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. Annex A 5.25 requires the organisation to assess information security events and decide whether they are to be categorised as incidents, which is the same core requirement. Both controls centre on event assessment/triage and the event-to-incident decision.

This control partially overlaps ISM-2148.

ISM-2148 requires revoking sessions and tokens when compromise is suspected, devices are non-compliant, or risky sign-ins are detected. Annex A 5.25 requires assessing information security events and deciding whether they should be categorised as incidents, which commonly includes analysing risky sign-in alerts or suspected credential compromise. They overlap where risky sign-in/compromise signals trigger both event assessment (Annex A 5.25) and containment via session/token revocation (ISM-2148), but Annex A 5.25 is focused on classification and decision-making rather than enforcing authentication state revocation.

This control supports ISM-0043.

Annex A 5.25 requires the organisation to assess information security events and decide whether they are incidents. ISM-0043 supports this by requiring an incident response plan that includes guidelines on what constitutes an incident and how incidents are reported and investigated, which operationalises consistent event-to-incident decisions. ISM-0043 extends beyond Annex A 5.25 into response execution, evidence integrity, and external engagement criteria.

This control depends on ISM-2116.

ISM-2116 requires organisations to use cyber threat intelligence services to support detecting events and identifying incidents. ISO/IEC 27001 Annex A 5.25 requires assessment of information security events and a decision on whether they are incidents, and ISM-2116 supports that decision by providing threat-informed criteria (e.g. whether observed indicators align to known threat actor behaviour, active exploitation in the sector, or confirmed malicious infrastructure). Annex A 5.25 is the governance decision point, whereas ISM-2116 focuses on intelligence enrichment that improves the accuracy and speed of categorisation.

This control depends on ISM-2132.

ISM-2132 requires central logging of certificate enrolment events and AD CS/template configuration changes to detect and investigate misuse. ISO/IEC 27001:2022 Annex A 5.25 requires assessing information security events and deciding whether they should be treated as incidents, which depends on having sufficient event data such as the PKI telemetry required by ISM-2132. Annex A 5.25 is process-oriented (triage/categorisation), while ISM-2132 is a specific technical logging requirement that feeds that process.

This control is equivalent to IT.DET-03.1.

IT.DET-03.1 requires alerts and events to be triaged in a timely manner to determine whether cyber security incident thresholds have been met. Annex A 5.25 requires information security events to be assessed and a decision made on whether to categorise them as information security incidents, which is substantially the same requirement. IT.DET-03.1 adds an explicit expectation of timeliness and refers to defined incident thresholds.

This control is broader than IT.DET-03.2.

IT.DET-03.2 requires cyber security incidents to be identified using indicators from across identities, applications, data and infrastructure activity rather than isolated signals. This is a specific requirement on how the assessment in Annex A 5.25 is carried out, where information security events are assessed to decide whether they are to be categorised as incidents. Annex A 5.25 covers the assessment and categorisation decision as a whole without prescribing the sources of indicators.