Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
BS ISO IEC 27035 — Information Security Incident Management Standard Series
Information technology — Security techniques — Information security incident management — Part 1 & Part 2
🛡️ BS ISO/IEC 27035 is the British Standards Institution (BSI) adoption of the ISO/IEC 27035 series, covering information security incident management as an information-security technique. No matter how well an organisation is defended, security incidents can happen; how to detect, respond, recover, and learn from them is a core capability of information security management. The series was prepared by UK technical committee IST/33/4 (Security Controls and Services) and carries ICS classification 35.040. The series currently comprises two parts: Part 1 specifies the principles of incident management and Part 2 specifies guidelines to plan and prepare for incident response. Together they supersede the withdrawn ISO/IEC 27035:2011.
💡 Incident management is not “after-the-fact remediation” but a closed loop covering “detect → respond → recover → learn”: Part 1 gives the management principles, and Part 2 gives how to plan and prepare in advance so that the organisation acts in an orderly way when an incident actually arrives.
1. Series Overview and Positioning 📌
Information security incident management works closely with the ISO/IEC 27001 information security management system (ISMS). The ISO/IEC 27035 series provides systematic principles and guidelines for incident management, helping organisations build effective incident-response capability.
The two parts currently in the BS ISO/IEC 27035 series are shown below. Part 1 establishes the management principles and framework, while Part 2 focuses on planning and preparation before an incident.
| Standard | Subject | Key Content | Edition |
|---|---|---|---|
| BS ISO/IEC 27035-1:2016 | Principles of incident management | Incident management principles, management framework, and phase division | First edition 2016-11-01 |
| BS ISO/IEC 27035-2:2016 | Guidelines to plan and prepare for incident response | Incident response planning, plan preparation, exercises, and readiness | First edition 2016-11-01 |
⚠️ This series supersedes the withdrawn BS ISO/IEC 27035:2011 (a single standard). When adopting, note the new two-part structure when updating an organisation’s incident-management documentation, and keep consistency with ISO/IEC 27001.
2. Incident Management Principles and Framework 🏗️
BS ISO/IEC 27035-1 specifies the principles of information security incident management, mainly covering:
- Incident management policy: the organisation should establish and implement an incident-management policy, clarifying objectives and commitment.
- Management framework and phases: divide incident management into phases such as planning and preparation, detection and reporting, assessment and decision, response, recovery, and post-incident learning.
- Roles and responsibilities: clarify the division of responsibility among the incident-response team, coordinators, and management.
- Coordination with the ISMS: incident management should be part of the ISMS, feeding into risk assessment and continual improvement.
3. Incident Response Planning and Preparation 🔧
BS ISO/IEC 27035-2 provides guidelines to plan and prepare for incident response, including:
- Incident response plan: develop a structured response plan covering escalation, communication, forensics, and business continuity.
- Response team building: form and train the incident-response team, clarifying roles and backup arrangements.
- Exercises and testing: test the plan through tabletop exercises and simulations to find weaknesses and improve.
- Tools and resources: prepare the technical tools and resources needed for logging, forensics, notification, and communication.
💡 “Preparation” is the watershed of incident management: organisations that have exercised beforehand typically show significantly shorter response times and lower losses than those that have not. The value of an exercise lies in “exercising”, not in “performing”.
4. Engineering Practice and Applications 🔍
ISO/IEC 27035 is widely used in security operations centres (SOC), CERT/CSIRT, and compliance audits. Engineering practice points include:
- Establish incident severity: grade incidents by impact and urgency, matching response priority and escalation paths.
- Evidence preservation: collect forensics during response, ensuring a complete evidence chain usable for later accountability and legal proceedings.
- Communication management: develop internal and external communication strategies, clarifying when, to whom, and how to disclose, balancing legal and reputational concerns.
- Post-incident improvement: conduct a post-incident review after the event, consolidate lessons learned, and update the plan.
5. Frequently Asked Questions ❓
❓ Q: How do Part 1 and Part 2 divide the work?
A: Part 1 specifies the incident-management principles and the overall framework (what and why), while Part 2 provides the guidelines for planning and preparation before response (how to prepare in advance); they are used together.
A: Part 1 specifies the incident-management principles and the overall framework (what and why), while Part 2 provides the guidelines for planning and preparation before response (how to prepare in advance); they are used together.
❓ Q: What is the relationship between incident management and ISO/IEC 27001?
A: ISO/IEC 27001 is the overall requirement for an information security management system, and incident management is an important component of it; ISO/IEC 27035 provides dedicated principles and guidelines for that component.
A: ISO/IEC 27001 is the overall requirement for an information security management system, and incident management is an important component of it; ISO/IEC 27035 provides dedicated principles and guidelines for that component.
❓ Q: Why is incident severity classification needed?
A: Different incidents vary greatly in impact and urgency; classification reasonably allocates response resources and determines escalation paths, avoiding both “over-handling small incidents” and “under-handling large ones”.
A: Different incidents vary greatly in impact and urgency; classification reasonably allocates response resources and determines escalation paths, avoiding both “over-handling small incidents” and “under-handling large ones”.
🔍 Q: Why is “evidence preservation” emphasised during incident response?
A: Because accountability, compliance, or legal action may be needed later. If the evidence chain is broken during response, the organisation weakens its basis for accountability and proof.
A: Because accountability, compliance, or legal action may be needed later. If the evidence chain is broken during response, the organisation weakens its basis for accountability and proof.