Introduction to ISO 27035

Introduction to ISO 27035

• ISO 27035:2018 is a standard for information security risk management.
• It guides the initiation, execution, and documentation of security incidents and related processes.
• It improves incident response by offering preventive and reactive measures for organizations.
• It goes beyond reacting to incidents, focusing on incident management and prevention.
• It's part of the ISO 27000 family of standards, supporting other information security standards and best practices.

Scope and Objectives of ISO 27035

• It provides a framework for the entire incident lifecycle.
• It covers planning, preparation, detection, analysis, containment, eradication, recovery, and post-incident activities.
• Its objective is improving an organization's ability to proactively prevent and react to security incidents.
• It promotes a structured, well-documented, and repeatable response.
• It emphasizes communication, coordination, and cooperation, both internally and externally.
• It encourages the use of a security incident response team and a well-defined process.

Key Concepts and Principles

• Proactive approach: Focuses on preventing incidents rather than only reacting.
• Proactive Risk Management: Organizations actively identify potential security threats and develop mitigation strategies.
• Lifecycle approach: Addresses the incident response process from beginning to end.
• Documentation: Crucial for every stage of the process, from planning to recovery.
• Communication: Effective communication between involved parties is essential.
• Coordination: Effective coordination, including with external bodies, is emphasized.
• Collaboration: Collaboration among internal and external stakeholders enhances responses.
• Collaboration: Information and lessons learned are shared across organizations.

Specific Areas Covered

• Planning: Develops incident response plans, procedures, and documentation.
• Preparation: Details staff training, communication protocols, and secure procedures.
• Detection: Explains methods for identifying and detecting security incidents.
• Analysis: Details incident analysis techniques for impact assessment and root cause identification.
• Containment: Specifies strategies for limiting the spread of incidents to minimize damage.
• Eradication: Addresses methods for eliminating the cause of incidents.
• Recovery: Illustrates restoring systems and data to their original state.
• Post-Incident Activity: Includes evaluating response effectiveness, learning from incidents, and improving future responses.

Relationship to Other ISO Standards

• Interoperable with other ISO 27000 series standards.
• Aligned and complementary with ISO 27001 (ISMS).
• Supports the implementation of good security hygiene.

Benefits of Implementing ISO 27035

• Improved incident response capabilities are achieved.
• Reduced impact from security incidents.
• Enhanced organizational and staff preparedness.
• Improved organizational and staff knowledge retention.
• Enhanced organizational reputation and stakeholder confidence.
• Strong stakeholder trust is fostered.
• Proactive incident management is enabled.