What is ISO 27035‑3 about?
The ISO 27035 series discusses information technology. ISO 27035‑3 gives guidelines for information security incident response in ICT security operations. ISO 27035‑3 does this by firstly covering the operational aspects in ICT security operations from a people, processes and technology perspective.
ISO 27035‑3 then further focuses on information security incident response in ICT security operations including information security incident detection, reporting, triage, analysis, response, containment, eradication, recovery and conclusion.
ISO 27035‑3 is based on the “Detection and reporting” phase, the “Assessment and decision” phase and the “Responses” phase of the “Information security incident management phases” model presented in ISO 27035‑1:2016.
Note: ISO 27035‑3 is not concerned with non-ICT incident response operations such as loss of paper-based documents.
Who is ISO 27035‑3 for?
ISO 27035‑3 on information security incident management is useful for:
- Cybersecurity teams
- Computer security incident response teams
- Software teams
- IT-based organizations that are looking to improve their security
- Any organization that wants to protect its digital data
Why should you use ISO 27035‑3?
The organizational structures for information security vary depending on the size and business field of organizations. As various and numerous incidents occur and are increasing (such as network incidents, for example, intrusions, data breaches and hacking). Concerns about information security have been raised by organizations. A secure ICT environment set up to withstand various types of attacks (such as DoS, worms and viruses) with network security equipment should be complemented with clear operating procedures for incident handling, along with well-defined reporting structures within your organization.
ISO 27035‑3 helps you to set up computer security incident response (CSIR) teams within your organization. The computer security incident response teams perform tasks such as monitoring, detection, analysis and response activities for collected data or security events. If you have outsourced your IT operations ISO 27035‑3 helps you to better understand the requirements and execution of incident operations that you could expect from your ICT supplier(s). ISO 27035‑3 also supports the controls of ISO 27001:2013, related to incident management.