# ISO/IEC 27035: Information security incident management

> Guidance for preparing for, detecting, responding to and learning from security incidents.

URL: https://securei3.com/standards/iso-27035/
Category: Information security & privacy: Guidance standard
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


The ISO/IEC 27035 series describes the incident management process (plan and prepare, detect and report, assess and decide, respond, and learn lessons) with guidance on incident response teams. We use it to build playbooks that meet ISO 27001, CERT-In six-hour reporting, DORA and other regulatory timelines.

## Who it is for

- Security operations and IT teams
- Regulated firms with tight incident reporting deadlines

## Benefits

- Faster, calmer incident response
- Reporting ready for regulators

## How Secure iQube helps

1. **Maturity review**: Assess current practice against the guidance and agree what good looks like for your organisation.
2. **Framework design**: Translate the principles into a practical framework, roles and tools that fit your existing management systems.
3. **Embedding**: Workshops and coaching so teams apply the framework in day-to-day decisions.
4. **Review and reporting**: Periodic reviews and reporting that show progress to leadership and stakeholders.

## Frequently asked questions

### Do we need a separate incident team?

Not necessarily. Smaller organisations often define roles across IT, legal and communications, with external support for forensics.

Related: https://securei3.com/standards/cert-in-directions/, https://securei3.com/standards/iso-27001/, https://securei3.com/standards/dora/

Contact: https://securei3.com/contact/: info@securei3.com