Key takeaways
- Assess security events to decide whether they are incidents.
- Not every alert is an incident.
- Start here: define criteria for what counts as a security incident.
Purpose
Assess security events to decide whether they are incidents.
Requirement
Requirement summaryThe organization shall assess information security events and decide if they are to be categorized as information security incidents.
Why it matters
Not every alert is an incident. A consistent triage step stops over-reaction and under-reaction.
How to implement
- Define criteria for what counts as a security incident.
- Assign who triages reported events and how quickly.
- Record each decision, including events judged not to be incidents.
- Feed patterns back into detection and awareness.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.25. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for deciding whether something is a security incident and how serious it is.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.25 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Your incident or ticket log showing each event was assessed and given a severity.
- Notes explaining why some events were not treated as incidents.
Things you should be able to show or explain
- Be able to show how a reported event is assessed.
How much to show: A handful of events from the last year.
Common mistakes
- No record of how decisions were made.
- Inconsistent severity ratings.
- No record of events dismissed as non-incidents.
- Severity decided differently by each person.
- Tip: Use a simple severity matrix for triage.
Policies & documents to have
- Incident Response Plan
FAQ
Is A.5.25 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.25?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for deciding whether something is a security incident and how serious it is…