ISO 27001 Annex : A.16.1.5 Response to Information Security Incidents, A.16.1.6 Learning from Information Security Incidents & A.16.1.7 Collection of Evidence

- May 25, 2021

In this article explain ISO 27001 Annex : A.16.1.5 Response to Information Security Incidents, A.16.1.6 Learning from Information Security Incidents & A.16.1.7 Collection of Evidence this controls.

A.16.1.5 Response to Information Security Incidents

Control- In the context of the documented procedures, information security incidents should be responded to.

Implementation Guidance- A nominated point of contact and other pertinent people within the organization or external parties should be able to respond to information security incidents.

The following should be included in the response:

Gathering evidence as soon as possible after the occurrence;
Conduct forensic security information analysis where necessary;
Escalation, wherein necessary;
Ensuring adequate documentation for subsequent analysis of all responses activities involved;
Communicate to other internal or external entities or organizations who need to know if an information security incident occurs or any specific details thereof;
Addressing the weaknesses identified for information security or contributing to the incident;
The formal closing and recording of the incident until effectively concluded.

The investigation should be performed after the incident to determine the cause of the accident, if appropriate.

Other information- The first goal of the response to an incident is to restore the ‘daily security level’ and then start the necessary recovery.

A.16.1.6 Learning from Information Security Incidents

Control – To minimize the risk or effect of potential accidents, the experience obtained from the study and mitigation of information security accidents should be used.

Implementation Guidance- Mechanisms will be in place to measure and track the forms, quantities, and costs of events affecting information security. In order to classify recurring or high impact events, the information obtained from the information security events assessment should be used.

Other Information- In order to minimize the occurrence, harm and expense of potential accidents, or take account of the security policy analysis process, assessment of information security accidents that suggest that improved or additional controls are required (refer 5.1.2).

Facts and figures from real events in the security of information can be used in user awareness training with due consideration of confidentiality (refer 7.2.2) as examples of how these events may be handled and how to prevent them in the future.

Also Read : A.16.1.2 , A.16.1.3 & A.16.1.4

A.16.1.7 Collection of Evidence

Control- The organization will define, obtain, procure and retain information as documentation and implement procedures.

Implementation Guidance- External protocols for treating evidence for administrative and legal action should be established and tracked.

In general, the processes of defining, gathering, acquiring, and preserving the proof should be in line with various media types, technologies, and device specifications e.g. based on or off.

The procedures will take into consideration:

Custody chain;
Evidence of security
Personnel security;
The staff’s roles and responsibilities;
Personnel competency;
Documentation;
Briefing.

Certification or all other applicable staff and instrument credentials should be pursued where possible in order to strengthen the validity of the evidence retained.

Forensic findings can extend beyond the boundaries of association or jurisdiction. In these cases, the organization should be given the right to collect the required information as forensic proof. In order to optimize admission opportunities across the qualified jurisdictions, the criteria of the different jurisdictions should also be considered.

-------------------------------------------------------------------------------------------------------------------------------------

This Blog Article is posted by

Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us – www.info-savvy.com

Search This Blog

IT Management & Cyber Security