ISO 27001 A.5.26: Coordinate Incident Response

What A.5.26 requires in practice

Control A.5.26 requires incidents to be responded to in line with the documented procedures. The procedures themselves come from planning; this control checks that they are actually followed when an incident occurs. The question an auditor asks is whether real incidents were handled the way the organisation said they would be.

In practice, response involves containing the problem, investigating it, restoring normal operation and communicating with those who need to know. It also involves coordination across technical teams, management and sometimes clients, suppliers or authorities. The control does not fix a response method. Playbooks for common incident types are one helpful approach, but the requirement is a response that follows what the organisation has documented and keeps a record of what was done.

Establish a coordinated picture of the incident

Confirm who leads the response, which services or information may be affected and what is currently known. Record significant decisions and distinguish verified facts from working hypotheses. Multiple teams can investigate different aspects, but their actions need coordination to avoid contradictory changes or accidental loss of evidence.

Set immediate objectives appropriate to the situation. A disclosure, unauthorised alteration and service outage may require different priorities. Where the incident crosses organisational boundaries, identify the authorised contacts and information-sharing arrangements. Do not assume that every participant needs every detail.

Contain consequences with informed authority

Containment may involve restricting access, suspending a transfer or isolating an affected service. Choose measures based on likely benefit, operational consequence and the competence required. A blanket instruction to disconnect equipment can be inappropriate where it creates other serious risks or destroys information needed to understand the event.

Use the agreed escalation route when a decision exceeds a responder’s authority. Record material trade-offs, including temporary restrictions and accepted residual exposure. Procedures should support judgement by competent personnel rather than encourage untrained staff to improvise technical actions.

Connect containment with evidence collection. Preservation needs and urgent protection can compete; the response lead should obtain suitable specialist advice when necessary. Do not delay essential protective action merely to create a perfect record, but document consequential decisions and limitations.

Why coordinated response matters to the business

The way an incident is handled often matters more to customers than the incident itself. A coordinated response limits harm, shortens disruption and preserves the information needed to understand what happened. An uncoordinated one leads to duplicated work, contradictory messages and missed obligations. Following documented procedures also shows regulators and clients that you act deliberately rather than by instinct. Where responders cannot follow the procedure because it is unrealistic, the gap is useful to know about: it is better found in review than during the next serious event.

How to implement A.5.26

Response works best when procedures are practical and rehearsed. The following sequence supports that. Real incidents rarely follow the plan exactly, so the aim is a response that stays organised when reality differs. Make sure the people named in the procedure know their role and have the access they need. Keep the record of actions as you go, since memory fades quickly and the record later supports review and any notification duties. Where you depart from the procedure, note why, because that is useful learning.

1. Confirm the documented procedures reflect how responders can actually work.
2. Assign an incident lead with authority to direct the response.
3. Keep a running log of actions, decisions and times.
4. Contain the problem first, then investigate causes and restore service.
5. Communicate with management, affected parties and others as the procedure directs.
6. Involve suppliers or specialists when internal capability is not enough.
7. Close the incident formally and pass it to review.

Illustrative software example: restoring an exposed service

Illustrative manufacturing example: uncertain production instructions

A hypothetical manufacturer discovers that electronic work instructions may have been altered without authorisation. Technical restoration from a previous copy is possible, but operations needs to know which version is trustworthy and what work relied on the affected instructions.

The response coordinates information security, document ownership and operational decision-making. Access is restricted appropriately while authorised personnel establish a reliable version and assess affected activities. The example shows why integrity incidents require business verification as well as a technically functioning system.

Communicate what is known and what happens next

Use authorised communication routes for management, affected teams and relevant external parties. State confirmed information, uncertainty and the next decision point. Uncontrolled speculation can undermine response and expose sensitive details; silence can also leave operational teams taking inconsistent action.

Assess external notification requirements through the organisation’s established legal and contractual process. ISO 27001 does not supply one universal deadline or recipient for every incident. Keep communications aligned with the available evidence and record significant approvals and updates.

Recover deliberately and close with a reason

Recovery should establish that required service and security conditions have been restored to an acceptable state. Define who can authorise return to normal operation and what checks support the decision. Consider whether temporary measures must remain while longer-term action continues.

Closing the incident is a deliberate decision, not merely changing a ticket status after service resumes. Record unresolved actions and their owners, preserve necessary records and arrange post-incident learning. The investigation may reveal control or risk-assessment changes beyond the affected system.

Evidence and common response failures