Key takeaways
- Plan how you will handle security incidents, with roles and procedures.
- A calm, practised plan turns a chaotic incident into a managed one.
- Start here: write an incident management policy and response plan with roles and contacts.
Purpose
Plan how you will handle security incidents, with roles and procedures.
Requirement
Requirement summaryThe organization shall plan and prepare for managing information security incidents by defining, establishing and communicating information security incident management processes, roles and responsibilities.
Why it matters
A calm, practised plan turns a chaotic incident into a managed one. Preparation is what auditors test first.
How to implement
- Write an incident management policy and response plan with roles and contacts.
- Define severity levels and escalation paths.
- Set up the tools and channels the response team will use.
- Train the team and run a tabletop exercise at least yearly.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.24. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your incident response plan: who does what, how incidents are reported and the steps to handle them.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.24 marked as used or not used, a short reason, and its current status.
Records and examples to show
- An up-to-date incident team contact list.
- Records of a practice exercise or real incident showing the plan was used.
Things you should be able to show or explain
- Incident team members should be able to explain their role.
How much to show: The plan plus one exercise or real incident.
Common mistakes
- Plan never practised.
- Out-of-date contact details.
- A plan that has never been tested.
- Contact details for people who have left.
- Tip: Run a tabletop exercise once a year.
Policies & documents to have
- Incident Response Plan
- Information Security Roles and Responsibilities Policy
FAQ
Is A.5.24 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.24?
Be ready to explain how the control works in your organisation and to provide things like: Your incident response plan: who does what, how incidents are reported and the steps to handle them…