Skip to main content
All measures

Measure · ISO 27001 and other standards

Prepare and exercise incident readiness

Prepare staffed reporting, reachable decision-makers and suitable response routes, then exercise them with a relevant scenario. Reuse the existing case record and recovery plan.

Accountable: Information security and incident coordination ownersReviewed

Reuse existing records

Reuse existing contacts, reporting procedures and response routes. The template brings their rules together. Keep actual cases in the Incident Report or existing record and recovery in the existing plan.

What to do

  1. 1

    Assign reachable responsibility

    Name the reporting contact that is actually staffed, its cover and an independent fallback route. Clarify receipt, coordination and available specialist competence for your operations. Keep required contacts and authority in the accessible operational copy and explain them to the people concerned. In the employee policy, explain that suspected events should also be reported as quickly as possible. Reports state known facts such as what happened, when and where, affected systems and actions already taken. Do not send passwords or unnecessary sensitive information. The person reporting does not try to exploit vulnerabilities or alter evidence without instruction.

  2. 2

    Prepare assessment and decisions

    Define suitable criteria for classification and prioritisation, response objectives and escalation routes. Clarify decision authority and the external reporting thresholds, start of deadlines, deadlines and recipients that actually apply, using the authoritative obligations record. A general time value does not replace this check.

  3. 3

    Connect existing procedures

    Check that required response and preservation procedures, authorised people and protected storage are actually available. Use the existing incident record for later events, decisions and evidence. Agree handover to the existing recovery plan and the contacts needed. Assign an owner and date to missing specialist or technical prerequisites.

  4. 4

    Exercise the prepared route

    Use a suitable scenario clearly identified as an exercise. Exercise reporting, the fallback route, classification, reachable decisions, escalation and required handovers with the roles actually involved. Record results and gaps in the existing exercise or task process. Follow corrections through to review. A discussion does not demonstrate technical recovery.

Worked example

A suspicious access is reported

Fictitious exercise: an employee notices unknown access to a project drive. The normal reporting channel is unavailable.

The fallback route is used
DecisionThe employee reaches the named deputy through the independent route. Coordination assesses known facts, priority and the next action.
EvidenceAn identified exercise record showing the roles actually reached, the decision and gaps found.

Record the result

  • Current procedures with reachable contacts, authority, criteria and usable fallback routes.
  • Results of a suitable exercise with gaps addressed through the existing process.

Common implementation mistakes

The portal fails with sign-in

Exercise an independent fallback route. Required contacts and authority must be available without normal sign-in.

The policy is mistaken for readiness

Check actual reachability, specialist competence and available resources. A template alone does not establish staffed reporting.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.5.24 · Planung und Vorbereitung des InformationssicherheitsvorfallmanagementsGerman guide

    The work establishes and exercises known reporting, coordination and response routes with actual roles, authority and available resources. Organisational introduction, competence and execution remain to be demonstrated.

  • A.5.25 · Beurteilung und Entscheidung über InformationssicherheitsereignisseGerman guide

    Preparation defines criteria, priorities and decision ownership and exercises assessment. Actual incoming events still require assessment and a reasoned decision based on the known facts.

  • A.6.8 · Meldung von InformationssicherheitsereignissenGerman guide

    The workflow communicates an easy reporting channel and fallback, explains prompt reporting of suspected events and the necessary facts without attempts to exploit vulnerabilities. The existing employee rule and exercise support actual use.

  • TISAX · 1.6.1

    VDA ISA 6.0.3 · Partial overlap

    Reachable staffed reporting and feedback routes are prepared and exercised with actual roles. Awareness, usable internal and external channels and applicable protection-need additions still require checking.

    Reference

  • TISAX · 1.6.2

    VDA ISA 6.0.3 · Partial overlap

    The work prepares classification, responsibilities, suitable response objectives, escalation and communication and exercises the decision route. It does not demonstrate actual handling, specific reporting obligations or all applicable protection-need and testing requirements.

    Reference

Templates for your implementation

Related resources

Sources and further reading