ISO 27001 controls: What is Annex A:16?

ISO 27001:2013 is the master shield that protects information security within integrated systems. At Citation Certification, the ISO 27001:2013 standard is readily available for certification via electronic assessments and audits worldwide. The ISO 27000 series is one of the most recognised information security standards globally, especially in today’s digital world.

Annex A:16 – Information Security incident management

Information security incident management involves identifying, managing, recording, and analysing security threats or incidents in real-time. Examples of security incidents include policy violations and unauthorised access to data such as health records, financial information, social security numbers, and personally identifiable records.

Annex A:16 focuses on managing incident reporting, analysing risk, and preventing recurrences.

Annex A:16.1 Management of Information Security incidents and improvements

The main objective of Annex A:16.1 is to ensure a clear and effective strategy for managing information security incidents and vulnerabilities, including communication.

Annex A:16.1.1 Responsibilities and roles

Organisations must establish procedures for a quick, effective, and orderly response to information security incidents. These procedures must define the roles and responsibilities of management. Effective coordination and development of these policies require planning, including monitoring, identifying, and reviewing protocols. Typically, a senior manager is responsible for these activities and delegates roles accordingly. Annex A:16 highly recommends maintaining a security incident plan and generating a recovery report thereafter.

“Threat is a mirror of security gaps. Cyber-threat is mainly a reflection of our weaknesses. An accurate vision of digital and behavioural gaps is crucial for consistent cyber-resilience.”
— Stephane Nappo

 

Annex A:16.1.2 Reporting Information Security events

Incident reporting protocols must be established. Ignoring such incidents could lead to significant information loss. Common reasons for reporting a security incident include ineffective security controls, breaches of information integrity or confidentiality, and availability issues.

Annex A:16.1.3 Reporting Information Security weaknesses

Both employees and contractors must be made aware that all security incidents need to be reported. For this purpose, a training module should be available and acknowledged by the appropriate users. For example, if someone cannot access information due to availability issues, it needs to be reported.

Annex A:16.1.4 Assessment of and decision on Information Security events

Information security events must be thoroughly assessed to determine if they qualify as security incidents. For instance, if an employee forgets their system password, it can be easily recovered. All information security events should be evaluated by the contact point on the agreed security event and classification scale to determine whether the event should be considered a security incident. Incident detection and prioritisation help assess the nature and severity of an incident.

Annex A:16.1.5 Response to Information Security incidents

When an incident occurs, a response incident plan must be readily available. Auditors will need to document the action plan based on knowledge gained while resolving security incidents. Organisations seeking ISO 27001 certification must have initial plans to control such breach events.

Annex A:16.1.6 Learning from security incidents

Any action plan used to resolve a security incident must be stored for future learning. This allows management to save time and energy by implementing these protective measures to deal with future threats. Knowledge gained from analysing risks and treatments should be shared with employees and stakeholders.

Annex A:16.1.7 Collection of evidence

Organisations must define, obtain, procure, and retain information as documentation and implement procedures. If a security incident may result in legal or disciplinary action, evidence collection should be carried out carefully, ensuring a good chain of custody and avoiding poor management. It’s important to gather information on security incident management clearly and to include disciplinary procedures. Everyone should know the precautions to take and the consequences for those who fail to take security seriously.