ISO/IEC 27035 series · Information security incident management
ISO 27035 implementation and requirements, so the next incident meets a team that has rehearsed it.
ISO/IEC 27035 is the international guidance series on handling information security incidents, from the first alert to the lessons that change your controls. Nobody is certified to it: it describes good practice, and the certificate organisations show customers is ISO/IEC 27001. Sterling's expert and experienced consultants turn the series into a working plan, trained teams and tested procedures, inside a management system an accredited body can certify. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced information security consultants, building incident response into live security programmes since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; where a certificate is needed, an accredited body audits your ISO/IEC 27001 system and decides
8,100+ client engagements in 60+ countries.
Information security client experience
What it is
What is ISO 27035 and what is it used for?
ISO/IEC 27035 is a multi-part series, published jointly by ISO and IEC through the committee responsible for information security, cybersecurity and privacy protection, that sets out how an organisation should manage information security incidents. It covers the whole life of an incident: the preparation done in quiet times, how events are spotted and reported, how someone decides whether an event is a real incident, how the response is run, and how the organisation learns so the same weakness is not exploited twice.
Organisations use it for three practical reasons. It gives IT, security, legal and management a common vocabulary before a crisis forces them together. It supplies a tested shape for the incident plan, the response teams and the exercises that keep them sharp. And it shows how incident handling fits an ISO/IEC 27001 system: Part 1 includes a cross-reference table between the two.
Current editions. ISO/IEC 27035-1:2023, Principles and process, and ISO/IEC 27035-2:2023, Guidelines to plan and prepare for incident response, were both published in February 2023 as second editions, replacing the 2016 versions. ISO/IEC 27035-3:2020, Guidelines for ICT incident response operations, was published in September 2020, and ISO/IEC 27035-4:2024, Coordination, in December 2024. The series is guidance throughout, so there is no transition deadline for any certificate. Check the edition of each part with ISO before you purchase copies.
Who it is for
Who needs ISO 27035?
The series is written to apply to any organisation, adjusted to its size, business and risk. In practice, four situations bring organisations to Sterling for incident management built on ISO/IEC 27035:
- A customer's security questionnaire asks how you handle incidents. Enterprise buyers want a defined process, response times and evidence that the plan has been exercised.
- A tender or contract sets incident obligations. Outsourcing and cloud contracts often require notification within agreed windows and cooperation in the client's investigation; the plan must make those commitments achievable.
- A regulator expects a documented response. Sector rules and data protection laws increasingly require incidents to be detected, assessed and reported to authorities or affected people. We align the process with those duties and work alongside your legal advisers on the obligations themselves.
- A parent company or group wants one approach. Subsidiaries that each react differently leave the group blind. Part 4 of the series addresses coordination across organisations, which suits groups, shared services and supply chains.
Requirements
What are the ISO 27035 requirements?
Strictly, the series makes recommendations rather than auditable requirements; your obligations come from ISO/IEC 27001, contracts and law. Each part has its own focus, and together they describe the areas an incident management capability should cover:
- Part 1, Overview: basic concepts, objectives, the benefits of a structured approach, adaptability, capability, communication and documentation.
- Part 1, Plan and prepare: the groundwork before any incident, from policy and plan to people and tools.
- Part 1, Detect and report: how events are noticed, by systems or people, and reported to those who can act.
- Part 1, Assess and decide: judging whether an event is an incident and how serious it is.
- Part 1, Respond: containing, resolving and recovering, with escalation where needed.
- Part 1, Learn lessons: feeding what happened back into controls, risk assessment and the plan.
- Part 2, Planning and preparation: the incident management policy, updates to wider security policies, the incident management plan with a classification scale and forms, the incident management and response teams and their competencies, internal and external relationships, technical support, awareness and training, testing through exercises, and capability monitoring.
- Part 3, ICT incident response operations: detection, reporting, triage, analysis, response, containment, eradication, recovery and conclusion for incidents in ICT environments.
- Part 4, Coordination: a coordinated process and key activities when several organisations handle an incident together.
What does useful incident management evidence look like?
An approved incident policy and plan; a classification scale that the service desk actually applies; a contact list for the response team, suppliers and authorities that someone checked this quarter; incident records showing timings, decisions and closure; exercise reports with the actions they raised; and post-incident reviews that changed a control or a risk rating. These records live in Effivity, so a customer's auditor or your certification body sees the process running.
Putting it into practice
How do you implement ISO 27035?
Because there is no certificate for the series, success is measured by how your organisation performs when an incident happens and, where needed, by an ISO/IEC 27001 certification that includes incident controls. Sterling follows five steps:
- 01Agree the scope and the obligations.Services, systems, sites and suppliers in scope, together with the customer, contractual and legal reporting duties the process must meet.
- 02Gap analysis: compare current practice with the series.We review how incidents are handled today against Parts 1 and 2, and Parts 3 and 4 where they apply, keep what works and set actions with owners and dates.
- 03Build the policy, plan and teams.Incident policy, plan, classification scale, reporting routes, playbooks for likely scenarios, and defined roles for incident management and response teams.
- 04Train, exercise and measure.Awareness for all staff, role training for responders, tabletop or technical exercises, and metrics that show whether the capability is improving.
- 05Learn, audit and sustain.Post-incident reviews feed controls and risk; internal audit checks the process, and where required it forms part of ISO/IEC 27001 certification.
Check the route before you sign. An offer of an "ISO 27035 certificate" is not an accredited certification, because no scheme for the series exists. If you need independent proof, ask which accredited certification body will certify your ISO/IEC 27001 system, under which accreditation and for what scope, and confirm those answers directly with the bodies concerned.
Cost
How much does ISO 27035 implementation cost?
Cost follows the incident landscape you prepare for: one on-call rota costs far less than shared services with outsourced monitoring in several countries. Every component of a Sterling proposal is visible and nothing is added later.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Services and systems in scope, maturity of existing procedures, number of playbooks and exercises, and whether your team drafts the material (Design™) or Sterling does (Drive™) |
| Independent certification | Only if ISO/IEC 27001 certification is in the plan: the certification body's audit days, locations and surveillance arrangements |
| Internal resources | Time from IT, security, legal and management for workshops and exercises, plus any tooling gaps the gap analysis finds |
| Software and learning | Included in a Sterling engagement: Effivity for incidents and actions, and Sterling Academy access, with users and access period confirmed in the proposal |
| Continued support | Annual exercises, plan reviews, internal audits and updates when services or suppliers change, under Sustain™ |
What moves the price
- How many services, sites and countries the plan must cover
- Whether monitoring and response are in-house, outsourced or mixed
- The number of reporting obligations the process must satisfy
- How many scenarios need their own playbook and exercise
- Whether ISO/IEC 27001 certification is part of the programme
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions in writing
- Certification-body fees shown separately where certification applies
- Effivity, training and Academy access itemised at no additional cost
- Milestones linked to deliverables such as the plan and the first exercise
- One all-inclusive proposal, with no surprises
Timeline
How long does ISO 27035 implementation take?
As an estimate, a working incident management capability typically takes two to four months; building it inside a full ISO/IEC 27001 programme takes longer. The pace is set less by writing the plan than by the steps around it:
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to IT, security and supplier contacts, and past incident records |
| Plan, teams and playbooks | Decisions on classification, escalation and authority to act, and legal review of reporting steps |
| Training and exercises | Availability of responders and managers, and time to close the actions an exercise raises |
| Audit and review | Enough incidents or exercises on record to show the process works, then internal audit |
Your engagement
What your ISO 27035 engagement includes
Sterling OS™ runs the engagement, applied to incident management. Sterling does not certify or attest anything: where a certificate is needed, an accredited certification body audits your ISO/IEC 27001 system and makes the decision.
Design™: guided support
Your team writes the policy, plan and playbooks; a Sterling consultant sets the structure from the series, reviews every draft and facilitates the first exercise.
Drive™: managed support
An alternative to Design™ when your people are stretched: Sterling drafts the material with your owners, runs the training and exercises and takes the programme to internal audit.
Sustain™: after go-live or certification
Yearly exercises, plan and contact-list reviews, internal audits and preparation for customer audits or ISO/IEC 27001 surveillance.
Automate™: Effivity
Incident logging, classification, actions, lessons learned and audits run in Effivity, included with the engagement at no additional cost.
Training for your people
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Certification decisions remain with the independent certification body.
Often combined with
Standards organisations pair with ISO/IEC 27035
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
- CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
- Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
- DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.
Effivity · incident management software, included in every engagement
How Effivity helps you fulfil, automate and simplify the guidance of ISO/IEC 27035.
Every Sterling incident management engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant sets up the workspace within the agreed scope, so incident reports, classification, response actions, lessons learned, risks, documents, training and audits sit in one place and every incident leaves a complete trail. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Policy, plan and contacts
The incident policy, plan and playbooks under version control, with the response-team and supplier contact list assigned an owner and a review date.
One place to report
Staff and systems log events through a single form, time-stamped at entry, so nothing is lost in an inbox or a chat thread.
Classification and escalation
Each report is classified against your scale, with the decision, the person who made it and any escalation recorded.
Actions with owners
Containment, recovery and notification tasks assigned and tracked to closure, with timings visible to the incident manager.
Post-incident review
Root cause, lessons and the corrective actions they trigger, linked back to the risk register and the controls they change.
Competence records
Awareness and responder training records for each person, linked to Sterling Academy, so evidence stays current as people join.
Exercises and metrics
Exercise schedules, reports and follow-up actions, plus dashboards on incident volume, response times and overdue actions.
Your own forms and reports
Fields, workflows and reports shaped to your classification scale and reporting duties, without code.
What this means at the audit
A customer's auditor or your ISO/IEC 27001 certification body will ask to see recent incidents, how they were classified, who decided, what was done and what changed afterwards. In Effivity each answer is a record with dates and owners, not a reconstruction from e-mails. Sustain™ continues in the same workspace, so the next exercise and the next audit find the process still running.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Existing incident logs and registers migrated, not retyped
- Admin and user training for your team
- Modules for ISMS, QMS, BCMS and more when you integrate other standards
Sterling Academy · information security e-learning
Make every employee a reliable first reporter of incidents.
Most incidents are first noticed by someone outside the security team. Sterling Academy trains the whole workforce and the people who run the process, with video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Security awareness for every employee, including how and when to report
- Internal auditor training for the people who will audit the process, as applicable to your standard, as part of the engagement
- Training status by department, ready for a customer or certification auditor
- New starters trained as they join, so evidence never goes stale
Keep exploring
Explore more about ISO/IEC 27035
Incident management resources
Services for ISO/IEC 27035
Why Sterling
Why choose Sterling for ISO 27035 incident management?
An incident plan proves its worth at three in the morning, when the people on call have to act without debate. Sterling builds the plan with the people who will use it, tests it before it matters and connects it to the rest of your security programme.
Security programmes in 60+ countries since 2003
Incident processes built for technology firms, BPOs, financial services and public-sector suppliers, with offices in 21 countries and one engagement team across your locations.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with any certification-body fees shown separately.
Plans that are rehearsed
Short playbooks, clear authority to act and exercises that expose the gaps while they are still cheap to fix.
Expert and experienced consultants
Information security consultants who have built incident management into ISO/IEC 27001 systems across sectors, and who know what customers and auditors ask to see.
The Sterling Promise
What our ISO/IEC 27035 success guarantee means
We stay with you until the agreed ISO/IEC 27035 outcome is achieved: the plan approved, the teams trained, the first exercise completed and its actions closed, and, where it is in scope, the ISO/IEC 27001 certification supported through to the decision.
The engagement identifies the standard, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed process into use. Where certification applies, the independent certification body assesses conformity and retains its decision. Our commitment concerns the agreed support, not a promise that no incident will ever occur.
FAQs
Frequently asked questions about ISO 27035
Can you get ISO 27035 certified?
No. The ISO/IEC 27035 series is guidance and there is no accredited certification to it. Organisations that need independent proof certify their ISO/IEC 27001 information security management system, which covers incident management, and use ISO/IEC 27035 to build that part well.
What is the difference between ISO 27035 and ISO 27001?
ISO/IEC 27001 sets certifiable requirements for a whole information security management system, including incident management controls; ISO/IEC 27035 explains in depth how to run incident management. One tells you what must exist and be audited, the other how to do one part of it properly.
Which part of ISO 27035 should we start with?
Start with Part 1 for the principles and five-phase process, then Part 2 to plan and prepare. Add Part 3 if you run ICT incident response operations yourself, and Part 4 if you regularly handle incidents with other organisations such as suppliers, group companies or clients.
Does ISO 27035 tell us when to notify a regulator?
No. The series recommends planning for communication with external parties, but notification deadlines and content come from the laws and contracts that apply to you. We build those duties into the plan and work alongside your legal advisers on the obligations themselves.
Is ISO 27035 suitable for a small organisation?
Yes. The series states it can be adjusted to an organisation's type, size and risk. A small firm may need a short plan, a small team with deputies, a supplier contact list and one exercise a year, rather than a dedicated response centre.
Keep exploring
More on ISO/IEC 27035 and related standards
More in Information security, cyber & cloud
Talk to a consultant
Prepare your team for its next information security incident.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice