ISO 27001 Annex A 5.26 Response to information security incidents
What it says
Information security incidents shall be responded to in accordance with the documented procedures.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure security incidents are handled quickly and effectively following set procedures.
This control is about being prepared to handle any security incidents, like a data breach, quickly and effectively. If these incidents aren't managed properly, they can lead to sensitive information being leaked, which can damage the organisation's reputation and result in legal penalties.
Free. Save your status, tasks and notes.
Why it matters
If incident response procedures are not followed, containment and recovery are delayed, increasing data loss, downtime, recovery costs, and stakeholder distrust.
How to implement
The IT manager should create a clear procedure for responding to security incidents.
This includes defining who is responsible for what actions and ensuring these steps are documented and easily accessible. Use the guidance in ISO 27002:2022 to make sure you're covering everything necessary, like containing the incident and collecting evidence.
Senior management must ensure that everyone in the organisation knows who to contact and what to do if they notice a security incident.
Organise regular training sessions so that all team members understand the procedures and why they are important, in line with Australian Privacy Principles (APP).
Appoint a designated incident response team that is competent and trained to handle security incidents effectively.
This team should regularly practice incident response scenarios to build efficiency and confidence in real-world situations, following the guidance from ISO 27002:2022.
Communicate with all relevant stakeholders during and after an incident.
The IT manager should ensure that clear communication lines are established and that the business continuity plans are ready to be implemented when needed, as outlined under CPS 234.
Regularly review and update your incident response procedures based on lessons learned from past incidents and changes in the technology landscape.
This ensures the organisation remains compliant with any new guidance from ISO standards or changes in Australian legislation, such as updates from the OAIC.
Keep it running
Maintain documented incident response procedures (triage, containment, escalation, communications). Review after incidents and test via tabletop exercises; refresh staff training quarterly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the documented information security incident response procedures.
Look at
Check if the procedures clearly outline roles, responsibilities, and the actions to be taken for different types of incidents.
Good evidence
Procedures should be comprehensive, regularly updated, and should clearly lay out all steps involved in responding to incidents.
- Check 2 of 5What an auditor asks for
Ask for
Ask for records of recent training sessions related to incident response.
Look at
Look at attendance records and training materials to ensure all relevant staff were trained and understand their roles in an incident.
Good evidence
Training records should show that all staff members were trained on incident response procedures within the past year.
- Check 3 of 5What an auditor asks for
Ask for
Obtain evidence of a designated incident response team and their training records.
Look at
Check if team members have relevant training and are regularly tested through drills or simulations.
Good evidence
The team should be made up of skilled individuals who have undergone specialised training within the last 12 months.
- Check 4 of 5What an auditor asks for
Ask for
Request communications or reports from past security incidents.
Look at
Review how incidents were reported and communicated to stakeholders, and whether business continuity plans were enacted.
Good evidence
Incidents should have clear, timely communication logs detailing the issue and resolution actions taken.
- Check 5 of 5What an auditor asks for
Ask for
Request post-incident analysis reports from recent incidents.
Look at
Examine if the reports identify root causes, document findings, and suggest improvements to avoid future incidents.
Good evidence
Reports should detail a thorough analysis of each incident with actionable insights to improve future response efforts.
Mappings
Closest match in ASD Essentials for enterprise IT: IT.RES-03.1, Respond to cyber security incidents using documented, tested and approved procedures, which asks for the same thing.
ASD Essential Eight: 8 mappings
This control is broader than E8-AC-ML2.9.
E8-AC-ML2.9 requires cyber security incidents to be reported promptly to the CISO (or delegate) after they occur or are discovered. Annex A 5.26 requires organisations to respond to information security incidents in accordance with documented procedures, which typically includes reporting and escalation steps. E8-AC-ML2.9 is a specific reporting/escalation requirement within the broader incident response procedural framework described by Annex A 5.26.
This control is broader than E8-AH-ML2.17.
E8-AH-ML2.17 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. Annex A 5.26 is broader because it requires organisations to respond to information security incidents in accordance with documented procedures, which can include reporting but also covers containment, eradication, and recovery activities. E8-AH-ML2.17 maps to a specific procedural requirement (external reporting to ASD) within the wider incident response capability expected by Annex A 5.26.
This control is broader than E8-AH-ML2.18.
E8-AH-ML2.18 requires that once a cyber security incident is identified, the organisation enacts (activates) its incident response plan. ISO/IEC 27001:2022 Annex A 5.26 requires incidents be responded to in accordance with documented procedures, which encompasses activating and executing an incident response plan as part of those procedures. Annex A 5.26 is broader because it covers the overall requirement to respond to incidents, not just the trigger point immediately after identification.
- E8-MF-ML2.10Report cyber security incidents to the Chief Information Security Officer promptlyBroader than
This control is broader than E8-MF-ML2.10.
E8-MF-ML2.10 requires cyber security incidents to be reported to the Chief Information Security Officer (CISO) or delegates as soon as possible after occurrence or discovery. Annex A 5.26 requires incidents to be responded to in accordance with documented procedures, which typically include escalation and internal reporting to accountable roles such as the CISO. Annex A 5.26 is broader because it covers the full incident response process, whereas E8-MF-ML2.10 focuses specifically on prompt reporting/escalation to the CISO.
This control is broader than E8-RA-ML2.12.
E8-RA-ML2.12 requires prompt reporting of cyber security incidents to ASD. Annex A 5.26 requires responding to information security incidents in accordance with documented procedures, which can include external notifications to authorities such as ASD. Annex A 5.26 is broader incident response governance and execution, while E8-RA-ML2.12 is one specific response requirement focused on timely ASD reporting.
- E8-AC-ML2.11Cyber security incident response plan is enacted after incident identificationPartially overlaps
This control partially overlaps E8-AC-ML2.11.
E8-AC-ML2.11 requires that, once a cyber security incident is identified, the organisation activates its incident response plan. Annex A 5.26 requires incidents to be responded to in accordance with documented procedures, which includes executing the defined response approach once an incident is being handled. Annex A 5.26 is broader around conducting response per procedure, while E8-AC-ML2.11 is specifically about the trigger to enact the plan immediately after identification.
This control partially overlaps E8-RA-ML2.11.
Annex A 5.26 mandates that incidents are managed following documented procedures. E8-RA-ML2.11 overlaps by requiring incidents be reported to the CISO quickly, a routine step in procedural responses. It's focused on notification, whereas Annex A 5.26 concerns the entire response process.
This control depends on E8-AC-ML2.8.
E8-AC-ML2.8 requires timely analysis of cyber security events so incidents are identified early. Annex A 5.26 requires responding to information security incidents according to documented procedures, which depends on incidents being identified and confirmed. Timely analysis under E8-AC-ML2.8 supports faster and more effective execution of the response activities required by Annex A 5.26, but it does not itself define response actions.
ASD Information Security Manual: 19 mappings
This control is broader than ISM-0123.
Annex A 5.26 requires incident response to follow documented procedures, which include internal notification and escalation steps. ISM-0123 specifically mandates prompt reporting of incidents to the CISO or delegate, aligning with the reporting/escalation element of response procedures. ISM-0123 focuses narrowly on internal reporting, whereas Annex A 5.26 covers a wider set of response actions.
This control is broader than ISM-0137.
ISM-0137 requires organisations to seek legal advice before allowing an intrusion to continue for evidence collection purposes. This supports Annex A 5.26 because incident response procedures should incorporate legal decision points and constraints, particularly when evidence collection and attacker engagement could affect liability or admissibility. Annex A 5.26 is broader in covering response activities overall, whereas ISM-0137 focuses narrowly on the legal-advice requirement for continued intrusion monitoring/collection.
This control is broader than ISM-0138.
ISM-0138 ensures evidence integrity through documented actions and chain of custody in line with law enforcement directions. ISO/IEC 27001:2022 Annex A 5.26 supports this by mandating incident responses using documented procedures, which includes evidence handling steps.
This control is broader than ISM-0917.
ISM-0917 defines a specific set of documented response steps for malicious code infections, including isolation, scanning media, removal, and restoration/rebuild. Annex A 5.26 requires that information security incidents are responded to in accordance with documented procedures across incident types. ISM-0917 is therefore a concrete, malware-focused instance of the broader incident response requirement in Annex A 5.26.
This control is broader than ISM-1213.
ISM-1213 describes a specific post-remediation activity involving seven days of network traffic capture for threat eradication validation. Annex A 5.26 involves responding to incidents through documented procedures. ISM-1213 supports Annex A 5.26 by specifying a technical validation measure that complements broader incident response efforts.
This control is broader than ISM-1591.
Annex A 5.26 mandates incident responses adhere to documented procedures. ISM-1591 supports this by requiring immediate suspension of access when malicious actions are detected, a typical containment action during response. ISM-1591 is a specific measure within the broader scope of Annex A 5.26.
This control is broader than ISM-1609.
ISM-1609 requires consulting system owners before permitting continued intrusion for evidence gathering. Annex A 5.26 encompasses broader incident response procedures, including decision-making for containment or monitoring, making ISM-1609 a specific authorization requirement within the broader process.
This control is broader than ISM-1731.
ISM-1731 requires that intrusion remediation planning and coordination be performed from trusted systems separate from any compromised system. Annex A 5.26 requires organisations to respond to information security incidents in accordance with documented procedures, covering the overall incident response process. ISM-1731 is a specific operational requirement within incident response (the trusted, out-of-band coordination environment), whereas Annex A 5.26 is broader and does not mandate that particular separation.
This control is broader than ISM-1880.
ISM-1880 requires that incidents involving customer data are communicated externally to customers and the public in a timely manner. ISO/IEC 27001:2022 Annex A 5.26 supports this by requiring incidents to be responded to in accordance with documented procedures, which typically include communication/notification steps and approvals. Annex A 5.26 is broader incident response execution and does not explicitly require external notification to affected customers or the public, which is central to ISM-1880.
This control partially overlaps ISM-0576.
Annex A 5.26 requires incidents to be responded to in line with documented procedures. ISM-0576 requires developing, implementing and maintaining an incident management policy and associated incident response plan, which provides the documented basis for those procedures. Implementing ISM-0576 ensures consistent alignment with Annex A 5.26's 'documented procedures' expectation.
- ISM-1732Coordinating and sequencing intrusion remediation to prevent re-compromisePartially overlaps
This control partially overlaps ISM-1732.
ISM-1732 requires intrusion remediation activities to be coordinated and sequenced to minimise re-compromise while maintaining business continuity. Annex A 5.26 overlaps because responding to incidents in accordance with documented procedures typically includes coordinated containment, eradication and recovery steps, including timing and dependencies. Annex A 5.26 is broader as a general incident response requirement, while ISM-1732 provides a more specific emphasis on sequencing remediation to prevent attacker re-entry during clean-up.
This control partially overlaps ISM-1803.
ISM-1803 requires documentation of incident response actions per incident in a register. Annex A 5.26 overlaps because it involves responding to incidents per documented procedures, which aligns with recording the type of response actions required by ISM-1803.
This control partially overlaps ISM-1956.
ISM-1956 necessitates rotating AD FS token-signing and encryption certificates twice in quick succession when compromise is suspected or confirmed, or annually. Annex A 5.26 addresses responding to information security incidents per documented procedures, with certificate rotation being a common containment step if federation credentials are compromised. ISM-1956 is a prescriptive technical response for AD FS certificates, while Annex A 5.26 covers incident response processes beyond certificate actions.
This control partially overlaps ISM-2106.
ISM-2106 requires staff to report cases where work-related skills and experience are posted on unauthorised online services. ISO/IEC 27001:2022 Annex A 5.26 requires incidents to be responded to in accordance with documented procedures. They overlap where the unauthorised posting is treated as a security incident (or precursor) that must be reported and then handled via incident response, but ISM-2106 is focused on staff behaviour/reporting while Annex A 5.26 is focused on organisational response processes.
This control supports ISM-1618.
Annex A 5.26 requires that incident response is executed in line with documented procedures. ISM-1618 assigns oversight responsibility to the CISO for the organisation's incident response, strengthening governance to ensure those procedures are followed. ISM-1618 is role/governance focused.
This control supports ISM-1784.
Annex A 5.26 requires responding to information security incidents in accordance with documented procedures. ISM-1784 requires exercising the incident management policy and response plan at least annually, which helps validate staff can follow the documented procedures during real incidents. ISM-1784 focuses on assurance/testing frequency.
This control supports ISM-1955.
ISM-1955 requires organisations to promptly change computer account credentials when compromise is suspected/confirmed, as well as on a 30-day cycle. This supports Annex A 5.26 because credential resets are a common containment and recovery action within incident response procedures. Annex A 5.26 is broader (covering end-to-end incident response), while ISM-1955 focuses specifically on one credential-focused response and hygiene measure.
This control depends on ISM-0043.
Annex A 5.26 requires information security incidents to be responded to in accordance with documented procedures. ISM-0043 establishes the required incident response plan content (definitions, reporting paths, roles/authorities, evidence integrity and contingency measures) that those procedures typically draw on. Including ISM-0043-style planning and documentation would ensure responses are consistently performed 'in accordance with documented procedures' as required by Annex A 5.26.
This control depends on ISM-2006.
ISM-2006 requires executives to plan for major cyber incidents and practise their response so they understand their duties. Annex A 5.26 requires incidents to be responded to in accordance with documented procedures. Executive planning and exercising in ISM-2006 strengthens and reinforces consistent execution of documented response procedures, but it does not itself define the operational procedures required by Annex A 5.26.
ASD Essentials for enterprise IT: 1 mapping
- IT.RES-03.1Respond to cyber security incidents using documented, tested and approved proceduresEquivalent
This control is equivalent to IT.RES-03.1.
IT.RES-03.1 requires documented, tested and approved cyber security incident response procedures to be used when responding to cyber security incidents. Annex A 5.26 likewise requires information security incidents to be responded to in accordance with documented procedures, so both address the same requirement. IT.RES-03.1 goes slightly further by also requiring the procedures to be tested and approved.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.