ISO/IEC 27035-1:2023 — Incident Management — Principles

Information security incidents are inevitable in modern organizations.
The sophistication of cyber threats, the expansion of attack surfaces, and
the increasing reliance on digital infrastructure demand a structured,
principle-based approach to incident management. ISO/IEC 27035-1:2023
establishes the foundational principles for information security incident
management, providing organizations with a framework to detect, report,
assess, respond to, and learn from security incidents.

Core Principles of Incident Management

The standard defines several fundamental principles that underpin an
effective incident management capability. First, senior management
commitment is essential — incident management cannot succeed without
visible leadership support, adequate resource allocation, and clear
assignment of responsibility. Second, the standard emphasizes a
risk-based approach: not all incidents warrant the same
level of response, and organizations must prioritize based on business
impact, legal obligations, and stakeholder expectations.

Third, ISO/IEC 27035-1 stresses the importance of continuous
improvement. Every incident, regardless of severity, offers
learning opportunities. Post-incident reviews, trend analysis, and
feedback loops into the information security management system (ISMS)
are critical components. Fourth, the standard advocates for
integration with broader management processes, including
business continuity management, risk management, and IT service management.
Incident management should not operate in a silo.

The Incident Management Lifecycle

ISO/IEC 27035-1 introduces a five-phase incident management lifecycle:
Plan and Prepare, Detect and Report, Assess and Decide, Respond, and
Learn. This lifecycle is iterative, with the “Learn” phase feeding
back into “Plan and Prepare” to drive continuous improvement. The standard
stresses that preparation is the most critical phase — organizations that
invest in planning, training, and tools before an incident occurs are far
more likely to contain damage effectively.

The detection and reporting phase includes establishing clear channels
for users, automated security tools, and external threat intelligence feeds
to report suspicious activity. Assessment and decision-making require
structured triage processes that evaluate technical impact, business
criticality, and legal or regulatory implications. The response phase
covers containment, eradication, and recovery actions, while the learning
phase ensures that knowledge gained from incidents is captured, analyzed,
and applied to improve future readiness.

Integrating Incident Management into Organizational Governance

The 2023 edition places stronger emphasis on governance integration
than its predecessor. Incident management must align with organizational
strategy, legal and regulatory obligations, and stakeholder expectations.
The standard recommends establishing an Incident Management Policy
that defines the scope, objectives, and responsibilities for the entire
program. This policy should be approved by top management and communicated
across the organization.

Furthermore, the standard introduces guidance on metrics and
performance measurement. Key performance indicators such as mean
time to detect (MTTD), mean time to respond (MTTR), and incident closure
rates provide visibility into the effectiveness of the incident management
program. Regular reporting to management and stakeholders ensures continued
support and resource allocation. The integration of incident management
metrics into broader security governance dashboards is strongly recommended
for organizations seeking to demonstrate due diligence and regulatory
compliance.

Frequently Asked Questions