ISO 27001:2022 Annex A Control 5.25

• See ISO 27002:2022 Control 5.25 for more information.
• See ISO 27001:2013 Annex A 16.1.4 for more information.

The Purpose of Annex A 5.25

ISO 27001:2022 Annex A 5.25 outlines how an organisation identifies and categorises information security incidents for prioritisation and handling as such by relevant parties. A detective control that identifies and prioritises information security incidents based on event-specific variables to maintain risk.

Who Has Ownership of Annex A 5.25?

In broader terms, Incident Management is usually applicable to service-related incidents.

Because Annex A 5.25 focuses specifically on data security incidents and breaches, taking into account their highly sensitive nature, ownership of Annex A 5.25 should ideally reside with the CISO (Chief Information Security Officer).

As CISOs are typically found only in large companies and enterprise-level organisations, ownership could also rest with the COO or Service Manager, depending on the organisation.

General Guidance on Annex A 5.25

Annex A 5.25 presents an approach to information security incident management that provides organisations with a broad operational scope rather than listing specific guidance points:

• In order to differentiate information security incidents from information security events, organisations should collaborate to agree on a categorisation system.
• There should be a point of contact who categorises information security events according to the categorisation scheme.
• During the assessment process, it is crucial to involve technical personnel with the necessary skills and tools to analyse and resolve information security incidents.
• The decision on whether or not to escalate an event to an incident should be made by all parties in collaboration.
• An organisation should record conversations, assessments, and categorisations to inform future information security incidents and event decisions.