ISO/IEC 27035 Foundation

An event is initially an observed change or activity. An alert draws attention to it but does not by itself prove an incident. Classification requires context and assessment. One failed login might be harmless, while several related indicators could justify further investigation and a coordinated response.

Not every disruption needs the same treatment. Assess whether information security is affected and what consequences are involved. An apparently routine outage may require further investigation. Shared criteria between operations and security teams help prevent reports from being dismissed too quickly or escalated without a clear reason.

Yes, if you report incidents, coordinate information or participate in operational decisions. Effective cooperation needs a shared vocabulary. Business teams, for example, should be able to describe observations without first proving the technical cause. Foundation helps you understand where your own responsibilities fit within the wider process.

Describe factually what you observed, when it happened, which systems or activities appear affected and how you can be contacted. Separate observations from assumptions. Follow your organisation’s reporting route and instructions; uncoordinated investigation can alter important information or make the subsequent coordinated response more difficult.

A useful distinction for your organisation is that the overall plan defines responsibilities, communication and decisions, while a playbook describes actions for a particular situation, such as a suspicious user account. They should fit together so individual actions are not triggered without a clear mandate or agreed escalation route.

Information security incidents can have different causes and affect different forms of information. Consider misdirected communications, lost documents or unintended changes when preparing your own processes. What matters is a reasoned assessment of the situation. Do not limit reporting from the outset to cases with an obvious identifiable attacker.

Foundation addresses the fundamentals of incident management. Specialist examination of digital evidence is a different learning objective. For your role, first understand responsibilities, pass information on clearly and avoid uncoordinated changes that could complicate an investigation by appropriately qualified specialists when forensic work is needed.

Let your responsibilities guide the choice. If you first need to understand reporting and workflows, a foundation perspective is appropriate. If you are expected to coordinate ownership, organise exercises or improve the overall incident-management process, a deeper management perspective becomes more useful. Match progression to responsibilities and practical experience.