ISO 27002:2022, Control 5.25 – Assessment and Decision on Information Security Events

Name: ISMS.online
Telephone: +441273041140
Price range: ££
Location: ISMS.online

ISO 27002:2022 Revised Controls

cultural,mix,of,young,people,working,in,a,company

Purpose of Control 5.25

Control 5.25 deals with an organisation’s ability to assess information security events and further categorise them as information security incidents, to be prioritised and dealt with as such by all relevant processes and personnel.

Attributes Table

5.25 is a detective control that maintains risk by ensuring that information security events are correctly categorised and prioritised as information security incidents, based on event-specific variables.

Control Type	Information Security Properties	Cybersecurity Concepts	Operational Capabilities	Security Domains
#Detective	#Confidentiality #Integrity #Availability	#Detect #Respond	#Information Security Event Management	#Defence

Ownership of Conotrol 5.25

Incident Management, in broader terms, is usually applicable to service-related incidents. Given that Control 5.25 deals specifically with information security-related incidents and breaches, taking into account the highly sensitive nature of these events, ownership of Control 5.25 should ideally reside with a CISO, or organisational equivalent.

Given that CISOs are usually only seen within larger companies and enterprise-level organisations, ownership could also reside with the COO, or Service Manager, depending on the nature of the organisation.

Jump to Topic

Purpose of Control 5.25
Attributes of Control 5.25
Ownership of Control 5.25
General Guidance on Control 5.25
Changes and Differences from ISO 27002:2013
How ISMS.online Helps

Since migrating we’ve been able to reduce the time spent on administration.

Jodie Korber

Managing Director Lanrex

100% of our users pass certification first time

Book your demo

General Guidance on Control 5.25

Instead of listing specific guidance points, Control 5.25 discusses a qualitative approach to information security incident management that provides organisations with a broad operational scope:

Organisations should collaborate to agree upon a clear categorisation system that escalates information security events to information security incidents, as distinct from one another.

The categorisation process should include a point of contact who assesses information security events using the categorisation scheme.

Technical personnel with the relevant skills and tools to analyse and resolve information security incidents should be involved in the assessment process.

All parties should collaborate to make a decision on whether or not an event warrants escalation to an incident.

Conversations, assessments and categorisations should be recorded to inform an organisation’s decision on future information security events and incidents.

Changes and Differences from ISO 27002:2013

27002:2022-5.25 replaces 27002:2013-16.1.4 (Assessment of and decision on information security events).

27002:2022-5.25 adheres to the same underlying operational principles as 27002:2013-16.1.4, with one small deviations.

27002:2013-16.1.4 refers to an information security incident response team (ISIRT) as being involved in the categorisation and escalation process. 27002:2022-5.25 makes reference to any staff members who are involved in analysing and resolving information security incidents.

In addition, 27002:2022-5.25 draws attention to the adequate categorisation of events, prior to escalation.

How ISMS.online Helps

With ISMS.online, ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process, from defining the scope of your ISMS through risk identification and control implementation.

Get in touch today to book a demo.

Are you ready for
the new ISO 27002

We’ll give you an 81% headstart
from the moment you log in
Book your demo

New Controls

ISO/IEC 27002:2022 Control Identifier	ISO/IEC 27002:2013 Control Identifier	Control Name
5.7	New	Threat intelligence
5.23	New	Information security for use of cloud services
5.30	New	ICT readiness for business continuity
7.4	New	Physical security monitoring
8.9	New	Configuration management
8.10	New	Information deletion
8.11	New	Data masking
8.12	New	Data leakage prevention
8.16	New	Monitoring activities
8.23	New	Web filtering
8.28	New	Secure coding

Organisational Controls

ISO/IEC 27002:2022 Control Identifier	ISO/IEC 27002:2013 Control Identifier	Control Name
5.1	05.1.1, 05.1.2	Policies for information security
5.2	06.1.1	Information security roles and responsibilities
5.3	06.1.2	Segregation of duties
5.4	07.2.1	Management responsibilities
5.5	06.1.3	Contact with authorities
5.6	06.1.4	Contact with special interest groups
5.7	New	Threat intelligence
5.8	06.1.5, 14.1.1	Information security in project management
5.9	08.1.1, 08.1.2	Inventory of information and other associated assets
5.10	08.1.3, 08.2.3	Acceptable use of information and other associated assets
5.11	08.1.4	Return of assets
5.12	08.2.1	Classification of information
5.13	08.2.2	Labelling of information
5.14	13.2.1, 13.2.2, 13.2.3	Information transfer
5.15	09.1.1, 09.1.2	Access control
5.16	09.2.1	Identity management
5.17	09.2.4, 09.3.1, 09.4.3	Authentication information
5.18	09.2.2, 09.2.5, 09.2.6	Access rights
5.19	15.1.1	Information security in supplier relationships
5.20	15.1.2	Addressing information security within supplier agreements
5.21	15.1.3	Managing information security in the ICT supply chain
5.22	15.2.1, 15.2.2	Monitoring, review and change management of supplier services
5.23	New	Information security for use of cloud services
5.24	16.1.1	Information security incident management planning and preparation
5.25	16.1.4	Assessment and decision on information security events
5.26	16.1.5	Response to information security incidents
5.27	16.1.6	Learning from information security incidents
5.28	16.1.7	Collection of evidence
5.29	17.1.1, 17.1.2, 17.1.3	Information security during disruption
5.30	New	ICT readiness for business continuity
5.31	18.1.1, 18.1.5	Legal, statutory, regulatory and contractual requirements
5.32	18.1.2	Intellectual property rights
5.33	18.1.3	Protection of records
5.34	18.1.4	Privacy and protection of PII
5.35	18.2.1	Independent review of information security
5.36	18.2.2, 18.2.3	Compliance with policies, rules and standards for information security
5.37	12.1.1	Documented operating procedures

People Controls

ISO/IEC 27002:2022 Control Identifier	ISO/IEC 27002:2013 Control Identifier	Control Name
6.1	07.1.1	Screening
6.2	07.1.2	Terms and conditions of employment
6.3	07.2.2	Information security awareness, education and training
6.4	07.2.3	Disciplinary process
6.5	07.3.1	Responsibilities after termination or change of employment
6.6	13.2.4	Confidentiality or non-disclosure agreements
6.7	06.2.2	Remote working
6.8	16.1.2, 16.1.3	Information security event reporting

Physical Controls

ISO/IEC 27002:2022 Control Identifier	ISO/IEC 27002:2013 Control Identifier	Control Name
7.1	11.1.1	Physical security perimeters
7.2	11.1.2, 11.1.6	Physical entry
7.3	11.1.3	Securing offices, rooms and facilities
7.4	New	Physical security monitoring
7.5	11.1.4	Protecting against physical and environmental threats
7.6	11.1.5	Working in secure areas
7.7	11.2.9	Clear desk and clear screen
7.8	11.2.1	Equipment siting and protection
7.9	11.2.6	Security of assets off-premises
7.10	08.3.1, 08.3.2, 08.3.3, 11.2.5	Storage media
7.11	11.2.2	Supporting utilities
7.12	11.2.3	Cabling security
7.13	11.2.4	Equipment maintenance
7.14	11.2.7	Secure disposal or re-use of equipment

Technological Controls

ISO/IEC 27002:2022 Control Identifier	ISO/IEC 27002:2013 Control Identifier	Control Name
8.1	06.2.1, 11.2.8	User endpoint devices
8.2	09.2.3	Privileged access rights
8.3	09.4.1	Information access restriction
8.4	09.4.5	Access to source code
8.5	09.4.2	Secure authentication
8.6	12.1.3	Capacity management
8.7	12.2.1	Protection against malware
8.8	12.6.1, 18.2.3	Management of technical vulnerabilities
8.9	New	Configuration management
8.10	New	Information deletion
8.11	New	Data masking
8.12	New	Data leakage prevention
8.13	12.3.1	Information backup
8.14	17.2.1	Redundancy of information processing facilities
8.15	12.4.1, 12.4.2, 12.4.3	Logging
8.16	New	Monitoring activities
8.17	12.4.4	Clock synchronization
8.18	09.4.4	Use of privileged utility programs
8.19	12.5.1, 12.6.2	Installation of software on operational systems
8.20	13.1.1	Networks security
8.21	13.1.2	Security of network services
8.22	13.1.3	Segregation of networks
8.23	New	Web filtering
8.24	10.1.1, 10.1.2	Use of cryptography
8.25	14.2.1	Secure development life cycle
8.26	14.1.2, 14.1.3	Application security requirements
8.27	14.2.5	Secure system architecture and engineering principles
8.28	New	Secure coding
8.29	14.2.8, 14.2.9	Security testing in development and acceptance
8.30	14.2.7	Outsourced development
8.31	12.1.4, 14.2.6	Separation of development, test and production environments
8.32	12.1.2, 14.2.2, 14.2.3, 14.2.4	Change management
8.33	14.3.1	Test information
8.34	12.7.1	Protection of information systems during audit testing

We’re cost-effective and quick

Discover how that will boost your ROI

Get your quote