A.5.25 Assessment and decision on information security events

Control objective

This control assesses information security events against predefined categorization and prioritization criteria and consistently decides whether each event should be classified as an information security incident. Not every event is an incident, so the essential task is to filter out false positives, duplicates, and minor events while quickly identifying events that require a real response. By recording the basis for each assessment and decision, the organization allocates response resources by priority and secures a starting point for later analysis and improvement.

Key checkpoints

Are criteria (severity/impact/priority) defined for deciding whether an information security event is classified as an incident?
Are received events assessed by a designated person/team (for example, a response team) against the defined criteria?
Are the assessment result, the incident classification decision, and its rationale recorded?
For events decided to be incidents, are they connected to a response and escalation procedure matching their grade/priority?
Are the assessment/decision criteria reviewed periodically to reduce false positives and missed detections?

Implementation guidance

Document a classification scheme (categories, severity grades, priorities) for deciding whether an event is an incident, and share it across the organization.
Designate an event intake channel (single point of contact) and operate a procedure that assesses received events against consistent criteria.
During assessment, jointly consider asset criticality, scope of impact, likelihood of spread, and legal/regulatory notification requirements.
Record the assessment result (incident/non-incident), classification grade, decision rationale, decision-maker, and timestamp in the incident management system.
Immediately connect events decided as incidents to the grade-based response procedure (A.5.26) and the escalation/notification path.
Periodically analyze false-positive/miss rates and reclassification cases to improve the classification criteria and thresholds.

Related controls and attributes

Evidence

Event/incident classification criteria and priority definitions
Event intake/assessment log (including assessment result, incident decision, and rationale)
Assessment/decision records in the incident management system (tickets)
Escalation/notification criteria and actual notification history
Classification criteria review/revision history and false-positive/reclassification analysis reports

Nonconformity examples

With no criteria for classifying events as incidents, judgments vary by individual and the response is delayed.
The basis for assessing/deciding on received events is not recorded, so the reasoning cannot be verified after the fact.
An event that is in fact an incident is misjudged as minor, and the response and notification deadlines are missed.
An event is decided to be an incident but is not assigned a grade/priority, so response resources are not allocated.
False positives recur but the classification criteria/thresholds are not reviewed, so a real incident is buried in noise.