ISO 27001 A.5.25 - Assessment and Decision on Information Security Events

Requirement

“The organization shall assess information security events and decide if they are to be categorized as information security incidents.”

Plain-language meaning

The organization must review reported security events and make a clear, recorded decision: is this just an event, or is it an information security incident that needs formal response?

Why this matters

Without triage, teams either overreact to noise or miss serious incidents. This control creates a consistent decision point before response resources are committed.

Implementation guidance

1. Define information security event and incident categories such as suspected event, minor incident, major incident, critical incident, privacy incident, supplier incident, and legal-notification candidate.
2. Define who receives reports and who can confirm incident classification. The first point of contact can make an initial assessment, but the incident response team or authorized role should confirm significant classifications.
3. Record the decision, justification, impact assessment, time received, time triaged, triage owner, escalation route, and notification deadline impact.
4. Set triage time targets that reflect legal, regulatory, contractual, customer, and internal notification expectations.
5. Review categories periodically so they stay clear and useful.

Audit guidance

Auditors should sample event and incident records and look for a clear decision point, consistent criteria, documented justification, and timely triage. They should interview points of contact to confirm they know reporting routes and classification guidance.

Evidence examples

Strong evidence

• Event records show receipt time, triage time, assessor, impact assessment, category, decision, and justification.
• Classification criteria are documented and available to points of contact.
• Major events are confirmed by the incident response role or team.
• Triage targets align with breach notification and contractual timescales.
• Changes to categorization guidance are communicated to points of contact.

Weak evidence

• Incident register exists but events are not recorded.
• Tickets are closed without explaining why they were not incidents.
• Triage depends on one person’s informal judgment.
• No documented incident categories or impact criteria.
• No evidence that notification timelines influence triage urgency.

Common failures

Exam traps

• A.5.25 is about assessment and decision, not full incident response.
• Not every information security event is an incident.
• The initial reporter or help desk may not be the final classification authority.
• The decision must be recorded; verbal triage is weak evidence.
• Notification obligations can affect triage urgency.

Related controls and concepts

• A.5.24 Information Security Incident Management Planning and Preparation
• A.5.26 Response to Information Security Incidents
• Incident Management Plan
• Incident Roles and Communications Matrix
• Internal Audit
• Management Review

KB-ready summary

A.5.25 requires a controlled part of the incident-management lifecycle: The organization must review reported security events and make a clear, recorded decision: is this just an event, or is it an information security incident that needs formal response? In practice, this means defined criteria, assigned ownership, recorded decisions, operating evidence, and improvement links back into the ISMS.

Templates and checklists

• Event Triage and Incident Classification Register
• A.5.25 Audit Checklist