ISO 27001:2022 · Organizational controls
ISO 27001:2022 5.25: Assessment and decision on information security events
ISO 27001:2022 5.25 covers Assessment and decision on information security events. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.5.25, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is No written criteria for when an event becomes an incident, so decisions are inconsistent.
Each information security event is to be assessed and a decision made on whether it counts as an information security incident. Purpose (stated in ISO/IEC 27002:2022): ensures information security events are categorized and prioritized effectively. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.25.
What evidence supports 5.25?
- Annex A organizational controlStatement of Applicability entry for control A.5.25, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A organizational controlThe agreed incident categorization and prioritization scheme with criteria for declaring an incident and consequence levels
- Annex A organizational controlTriage records showing each reported event assessed against the scheme
- Annex A organizational controlDetailed decision records identifying who assessed the event, the categorization and the rationale
- Annex A organizational controlEvidence that assessors are the designated incident coordination and response personnel
Where this requirement comes from
This is our own statement of ISO 27001:2022 5.25, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- No written criteria for when an event becomes an incident, so decisions are inconsistent
- Events closed as non-incidents without any recorded rationale
- Triage is done by whoever receives the alert rather than designated personnel
- Priority is set by gut feel rather than a consequence-based scheme
How it maps to SOC 2
- CC7.3 high Assessment and decision on security events determines incident status.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.