ISO/IEC 27035
Definition
An international standard for information security incident management. Part 1 covers principles and concepts; Part 2 covers planning and preparation. It defines a five-phase model and aligns with the broader ISO/IEC 27000 family of standards used in audit and certification contexts.
- Subject
- Information security incident management
- Part 1
- Principles and concepts
- Part 2
- Planning and preparation
- Phase model
- Five phases
Common questions
How does this standard relate to a practical incident response playbook?+
It supplies the underlying principles and a phase structure that an organisation's own incident response plan is built around, but it is not itself a step-by-step playbook. Teams typically map their internal procedures to its phases when preparing for an audit or certification review.
How does it differ from frameworks like NIST SP 800-61?+
Both cover the incident management lifecycle, but ISO/IEC 27035 is written to interoperate with the wider ISO/IEC 27000 family for organisations pursuing 27001 certification, while NIST SP 800-61 is a US government framework used independently of ISO certification.
Related terms
- CREST
- A UK-based not-for-profit professional body that publishes practitioner-focused incident response guidelines and operates accreditation schemes for IR service providers. CREST guidance emphasises...
- Framework Blending
- The practice of combining elements of multiple IR frameworks: for example, using NIST as the strategic backbone, SANS phase names in operational...
- NIST SP 800-61
- The US National Institute of Standards and Technology's Computer Security Incident Handling Guide. It defines a four-phase IR lifecycle: Preparation; Detection and...
- Phase Granularity
- The number and specificity of discrete steps a framework defines within the IR lifecycle. Higher granularity, as in SANS PICERL's six steps...
- SANS PICERL
- A six-step incident response model developed through SANS Institute training: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. PICERL breaks NIST's combined response...