Principles and process
Use this part to frame the incident-management lifecycle, decisions and handoffs.
Official part record ↗ISO & IEC / Series
ISO/IEC 27035-1:2023, -2:2023, -3:2020 Prepare, respond and learn
The 27035 series connects incident preparation with detection, assessment, response and learning. Its parts let a team distinguish the overall process, readiness work and operational ICT response.
The place in the system
Where it fits
It provides specialist incident-management guidance that can support response-related controls and improvement within an ISO/IEC 27001 ISMS.
Multipart series
Choose the right part
Each part has its own edition and publisher record.
Preparation for response
Use this part to organize response readiness, coordination and lessons learned.
Official part record ↗ICT response operations
Use this part when shaping the technical response workflow for ICT incidents.
Official part record ↗Practical interpretation
How to use this reference
These are editorial starting points, not copied requirements or an implementation checklist from the standard.
Questions and actions
- Define who receives, classifies and escalates suspected incidents.
- Exercise decisions across technical and business roles before a serious event.
- Feed lessons from real incidents back into risk and control reviews.
Evidence to look for
- Incident roles and escalation map
- Exercise or tabletop record
- Post-incident improvement log
Illustrative example
What it could look like
A supplier alerts a company to suspicious activity in a shared service. The team uses its prepared handoffs to assess impact, coordinate technical response and turn the outcome into control changes.
Boundary to keep clear
The series is not a single 2023 document; Part 3 is limited to ICT response operations and does not set legal notification deadlines.
Source and edition check
Open the official record
Research checked 2026-10-20. Catalogue status and edition can change; the official publisher record controls. Full standard text is not reproduced here.