ISO 27001 A.5.26 - Response to Information Security Incidents

Requirement

“Information security incidents shall be responded to in accordance with the documented procedures.”

Plain-language meaning

Once an event is categorized as an incident, the organization must respond using documented procedures rather than improvising.

Why this matters

Incident response involves technical, business, legal, communication, evidence, recovery, and management decisions. Documented procedures keep response coordinated and defensible under pressure.

Implementation guidance

1. Document incident response procedures for likely scenarios such as ransomware, account compromise, data leakage, lost device, supplier breach, cloud incident, and service outage.
2. Assign response responsibilities, escalation authority, communications ownership, and evidence preservation duties.
3. Decide early whether evidence collection or legal defensibility is required because that changes how systems, logs, images, and communications should be handled.
4. Record incident actions, decisions, approvals, containment, eradication, recovery, communication, and closure.
5. Use management control for major decisions such as service shutdown, customer notification, regulator contact, legal hold, or supplier escalation.

Audit guidance

Auditors should verify that incident procedures exist, responsibilities are defined, and sampled incident records show response activities followed the documented process.

Evidence examples

Strong evidence

• Incident records map to documented procedure steps.
• Roles and responsibilities are visible in the response record.
• Containment, eradication, recovery, communication, and closure decisions are timestamped.
• Evidence collection decisions are made early and recorded.
• Management approval is present for high-impact decisions.

Weak evidence

• A plan exists but incidents are handled entirely in chat.
• No timestamps or decision log.
• No evidence of containment or recovery validation.
• Responsibilities are unclear during response.
• Evidence needs are considered only after systems are changed.

Common failures

Exam traps

• A.5.26 is response execution, not planning only.
• Documented procedures are required; heroic ad hoc response is weak.
• Evidence collection must be considered early.
• All follow-up activities should be recorded.
• Management control matters for significant incidents.

Related controls and concepts

• A.5.24 Information Security Incident Management Planning and Preparation
• A.5.25 Assessment and Decision on Information Security Events
• A.5.27 Learning from Information Security Incidents
• A.5.28 Collection of Evidence
• Incident Management Plan
• Corrective Action Tracker

KB-ready summary

A.5.26 requires a controlled part of the incident-management lifecycle: Once an event is categorized as an incident, the organization must respond using documented procedures rather than improvising. In practice, this means defined criteria, assigned ownership, recorded decisions, operating evidence, and improvement links back into the ISMS.

Templates and checklists

• Incident Response Record
• A.5.26 Audit Checklist