Get compliant with ISO:27001 – Annex A.16 and simplify compliance for your organisation.
To ensure the implementation of a consistent and effective process that manages security incidents.
To ensure that there is a procedure in place to detect system weaknesses and reduce the risk of any incidents. There should be monitoring, identification, analysis and reporting of any incidents relevant to information security. These procedures should be logged and managed. Competent and authorised personnel should handle these security issues, and any relevant external parties should be contacted.
To ensure that there is a clear and easy to follow procedure for employees or interested parties to report any security incidents to authorised staff as soon as possible. Both employees and management should be made aware of their responsibility to do this and how to achieve and maintain information security.
To ensure that employees are informed about how to deal with and report information security weaknesses to management. There should be a procedure in place for employees to follow. The system for reporting security weaknesses should be clear and easy to use.
To ensure that any reported issues about security incidents and weaknesses are assessed and classified as such. The team can then decide on a plan to deal with resolving these issues. The resolution should have as little impact as possible on the organisation’s activities.
To ensure that relevant reports of security weaknesses and incidents are responded to and resolved. The incident responder would be required to collect evidence of the incident, determine a root cause, log and verify that the data of the incident is stored in the system, and notify management and all interested parties. Any investigation should be performed after the incident, so that the cause can be determined.
To ensure that the incident analysis result will be used to learn more and improve information security, preventing repetition of the incident. Logs and evidence from the incidents can be later used in user awareness training for employees, to prevent them in the future.
To ensure the organisation defines, obtains, procures and retains information as documentation. This is performed in case a company needs to exercise criminal or civil action. Protocol for treating evidence should be established and followed. To strengthen the validity of the evidence, certifications and other credentials of applicable staff should be pursued.