Response to information security incidents

Why it matters

This is what an auditor actually wants proof of — that when something happened, you followed your own plan.

How a self-led small team implements it

Even a near-miss written up against your incident plan counts as real evidence this control works.

What auditors expect to see

Incident log, post-incident notes.

More organizational controls

• A.5.1 Policies for information security
• A.5.2 Information security roles and responsibilities
• A.5.3 Segregation of duties
• A.5.4 Management responsibilities