A.5.27
Learning from information security incidents
Organizational controlsCheckpoints 5Evidence 6Cases 6
Control objective
This control uses the knowledge gained from information security incidents (and comparable near-misses and vulnerabilities) to reduce the likelihood and impact of recurrence and to continually improve the organization's controls, procedures, and response capability. It requires more than handling and closing individual incidents: it calls for a feedback loop in which root causes are analyzed and lessons are fed back into policy, risk assessment, technical controls, training, and incident response procedures. A further aim is to accumulate data on incident types, scale, and causes so that recurring patterns can be identified and used to inform management decisions and resource allocation.
Key checkpoints
- Are procedures and responsibilities defined for conducting root cause analysis and capturing lessons learned after an incident is closed?
- Are lessons from incidents translated into actual improvements to policies, procedures, technical controls, risk assessments, and training, with their implementation tracked?
- Are incident type, frequency, cause, impact, and response cost aggregated quantitatively and qualitatively to analyze recurring patterns and trends?
- Are major and recurring incidents reported to management, with improvement priorities decided on that basis?
- Are incident cases and lessons shared with relevant staff and teams to raise awareness and strengthen response capability?
Implementation guidance
- Include a post-incident review step in the incident closure procedure, and scale the review format (a brief record or a formal post-incident review meeting) and the participants to the incident's scale and severity.
- Apply root cause analysis (RCA) techniques to identify not only technical causes but also procedural, human, and managerial ones, and derive measures to prevent recurrence.
- Register lessons learned as improvement items with an owner, deadline, priority, and status, and confirm their completion (updating risk assessments, strengthening controls, revising procedures, feeding into training).
- Record incident data using a standardized taxonomy (type/asset/cause/impact) so that metrics such as volume, distribution by type, mean response time, and loss magnitude can be produced and trends analyzed.
- Use recurring or major incidents as input to management review and to risk assessment/improvement activities, and to support decisions on needed resources and investment.
- Share incident cases and lessons with relevant staff in a form that removes or anonymizes sensitive information, and reflect them in awareness training and response exercise scenarios.
- Integrate weaknesses identified in incident response drills/simulations into the same lessons-learned management process for improvement.
Evidence
- Incident management policy/procedures covering post-incident review and lessons-learned capture
- Post-incident review minutes/reports and root cause analysis (RCA) results for each incident
- Lessons-based improvement item list (owner/deadline/status) and evidence of completion (policy revisions, control changes, risk assessment update history)
- Incident statistics/trend analysis (metrics such as volume by type, response time, loss magnitude)
- Management reports and review records for major/recurring incidents
- Incident case/lesson sharing materials and the awareness training/response exercises that incorporate them
Nonconformity examples
- Incidents are only recovered and closed, with no root cause analysis or post-incident review performed at all.
- Lessons are captured in a post-incident review but are not registered or tracked as improvement items, so they never lead to actual control improvement.
- The same type of incident recurs, yet there is no trend analysis or measure to prevent recurrence.
- Incident data is recorded sporadically without a taxonomy, making aggregation and metrics by type/cause impossible.
- No record exists of management reporting or of the basis for improvement priorities for major incidents.
- Incident lessons are not shared with relevant staff or reflected in training, so they do not translate into stronger organization-wide response capability.