ISO 27001 A.5.24: incident readiness, explained for startups

A.5.24 Information security incident management planning and preparation

You have a plan and named people ready for security incidents. What proves it: an approved incident response plan with named roles, and a record that it was tested.

A certification auditor samples the incident response plan and a tabletop exercise record. A file that usually does the job: the incident response plan with roles, plus notes from a one hour tabletop exercise.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.5.24 walks you through it in this order.

1. Approve the incident management policy in Policies.
2. Name an incident lead and a backup.
3. Run a short tabletop exercise and keep the notes.

The free ISO 27001 readiness assessment asks one question that evidences it:

• Do you have an incident response procedure and a log of incidents?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Information Security Incident Management Policy covers A.5.24. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criteria that cover this ground: CC7.3, incident triage and CC7.4, incident response.

Organizational controls

A.5.24 is one of the 37 organizational controls in Annex A. How the company runs security: policies, roles, suppliers, incidents, continuity and legal duties. Most of these are written decisions and the records that show you follow them.

Nearby controls in the same theme:

• A.5.21, technology supply chain
• A.5.22, watching your suppliers
• A.5.23, cloud services
• A.5.25, triaging security events
• A.5.26, responding to incidents
• A.5.27, learning from incidents

Before it: A.5.23, cloud services. After it: A.5.25, triaging security events. Every control, by theme, is on the Annex A controls page.