Skip to main content
All measures

Measure · ISO 27001 and other standards

Handle and review security incidents

Handle a specific incident through the prepared process, protect evidence and turn lessons into effective changes. Use the existing case record.

Accountable: Incident coordination and authorised specialist ownersReviewed

Reuse existing records

The incident management policy defines roles and procedures. The existing Incident Report records the actual case. Keep technical restoration in the recovery plan and improvements in the existing corrective process.

What to do

  1. 1

    Coordinate response and maintain the case

    Confirm classification, priority and ownership based on the known facts. Use the existing Incident Report or record for the timeline, decisions, work and results. Authorised specialists contain spread and damage through the prepared procedures. Consider operations and evidence at risk and bring in required support.

  2. 2

    Preserve required evidence appropriately

    Clarify authority and possible use. Choose the procedure for the medium, device and operational state. Record source, preservation time, person, method and condition. Check required integrity and agreement between original and copy. Protect originals and working copies, limit access and record transfers or processing in the same case. Involve suitable support early if legal use is possible.

  3. 3

    Agree communication and recovery

    Check the reporting obligations actually triggered, including known facts, start of the deadline and recipient. Record the decision, approved communication, dispatch and required follow-up reports. Inform authorised parties through suitable routes and give the reporter feedback where possible. Hand restoration to the existing plan with known causes and open security questions; technical and business approvals remain there.

  4. 4

    Apply lessons and reach a reasoned closure

    Review the sequence, causes and safeguards that failed. Use existing incident data to consider types, frequency and costs and serious or recurring patterns. Update affected risks, procedures, safeguards or briefings at their authoritative source. Keep ownership and follow-up work in the existing process and check effectiveness. The authorised role decides closure based on the state achieved; limitations and outstanding work remain visible.

Worked example

A compromised mailbox is handled

Fictitious example: assessment confirms unauthorised access to a business mailbox. The responsible roles activate the existing process.

Response and evidence
DecisionAuthorised specialists agree containment and suitable preservation of the traces needed. The case record refers to protected storage and records interventions and transfers.
EvidenceIncident Report with the decision timeline and references to technical preservation records.
Review and change
DecisionThe team reviews the cause and failed safeguards. It updates the affected access rule, implements the required change and checks its effect. Reporting decisions remain traceable in the case.
EvidenceA linked change with an owner, actual review result and reasoned closure.

Record the result

  • Existing case record with assessment, timeline, response, reporting decisions, protected evidence references and closure.
  • Traceable lessons and their connection to implemented improvements and effectiveness checks.

Common implementation mistakes

Preservation is declared court-proof

Integrity and traceability support use. Legal admissibility depends on the case and applicable requirements.

The service runs and the case is closed

Check open security questions, obligations and improvements. Technical restoration alone does not end incident handling.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.5.26 · Reaktion auf InformationssicherheitsvorfälleGerman guide

    The guidance connects coordinated response, records, communication, handover and reasoned closure in the existing case. The organisation provides suitable competence, technical interventions and actual results.

  • A.5.27 · Erkenntnisse aus InformationssicherheitsvorfällenGerman guide

    Review connects causes, types, frequency and costs to changes in risks, safeguards, procedures and briefings and their effect. An archived review alone is insufficient.

  • A.5.28 · Sammlung von BeweismaterialGerman guide

    The work connects authority, preservation suitable for the medium and state, origin, integrity checks, protected storage and traceable transfers. Competent acquisition and case-specific legal admissibility still require checking.

  • TISAX · 1.6.2

    VDA ISA 6.0.3 · Partial overlap

    Coordinated handling, reasoned prioritisation, communication and learning contribute to managing reported events. Other applicable categories, protection-need additions, partner responses and organisational requirements remain to be addressed.

    Reference

Templates for your implementation

Related resources

Sources and further reading