Compliance FrameworksInternational
ISO/IEC 27035
Information security incident management - principles, IR plan, coordination, lessons learned.
Information security incident management - principles, IR plan, coordination, lessons learned.
| Short name | ISO 27035 |
| Region | International |
| Country or scope | International |
| Sector | General |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers ISO 27035
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for ISO 27035.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for ISO 27035 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ISO27035-PLAN Plan and Prepare Documentation | Incident management requires prepared, current documentation of the environment to be defended, evidenced by identifiable and timestamped records of deployed software (ISO/IEC 27035-2 plan-and-prepare phase) | Scan |
ISO27035-DETECT Detection Baseline | Effective detection and reporting of incidents presumes knowing what software is running so anomalies and affected assets can be recognised, i.e. a maintained component inventory (ISO/IEC 27035-1 detection and reporting phase) | Scan |
ISO27035-ASSESS Assessment and Decision Readiness | Assessing whether an event is an incident and deciding severity requires unambiguous identification of the components involved so they can be matched against threat intelligence (ISO/IEC 27035-1 assessment and decision phase) | Scan |
ISO27035-RESP Response Scoping by Version | Responding to incidents, including containment and eradication, requires version-level knowledge of deployed software to scope which instances are affected (ISO/IEC 27035-1 response phase) | Scan |
ISO27035-CONTACT Incident Reporting Contact Points | Incident management planning requires established points of contact for reporting and coordination, evidenced by contact details recorded with the software documentation (ISO/IEC 27035-2 incident management plan and contact provisions) | Scan |
ISO27035-SHARE Structured Records for Coordination | Coordination and lessons-learned activities depend on structured, shareable records, which for software estates means standardised machine-readable formats (ISO/IEC 27035-1 lessons learned and information sharing principles) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
5.1 | Plan and Prepare |
5.2 | Detect and Report |
5.3 | Assess and Decide |
5.4 | Respond |
5.5 | Lessons Learnt |
6.1 | ISIRT Establishment and Structure |
6.2 | ISIRT Competence and Training |
7.1 | Incident Communication: Internal |
7.2 | Incident Communication: External |
7.3 | Evidence Collection and Preservation |
Policy templates
Written for ISO 27035:
- Information Security Incident Response Plan
- ISIRT Charter: Information Security Incident Response Team
- Incident Communication Procedure
And 22 from the standard set, adapted to ISO 27035.