Key takeaways
- Respond to incidents according to your documented procedures.
- When an incident is confirmed, a documented response keeps containment, communication and recovery on track.
- Start here: follow the response plan: contain, eradicate, recover.
Purpose
Respond to incidents according to your documented procedures.
Requirement
Requirement summaryInformation security incidents shall be responded to in accordance with the documented procedures.
Why it matters
When an incident is confirmed, a documented response keeps containment, communication and recovery on track.
How to implement
- Follow the response plan: contain, eradicate, recover.
- Keep a timeline of actions and decisions.
- Notify customers, regulators or authorities where required.
- Close the incident formally once recovery is confirmed.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.26. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your incident handling steps: contain, fix, recover and communicate.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.26 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Your incident log showing what was done and when for recent incidents.
- Records of who was told and when.
Things you should be able to show or explain
- Be able to walk through how a recent incident was handled.
How much to show: Three to five incidents of different severities.
Common mistakes
- Incidents closed with no record of action.
- No timeline kept.
- Fixing the issue without recording what happened.
- Missing legal notification deadlines.
- Tip: Keep an incident log with timestamps and decisions.
Policies & documents to have
- Incident Response Plan
FAQ
Is A.5.26 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.26?
Be ready to explain how the control works in your organisation and to provide things like: Your incident handling steps: contain, fix, recover and communicate…