ISO/IEC 27035: Incident management
ISO/IEC 27035 is the reference standard for information security incident management. It describes the processes and roles needed to detect, record, analyse and respond to incidents consistently.
The five phases of the cycle
Planning and preparation: policies, roles, tools and exercises.
Detection and reporting: identifying and escalating suspicious events.
Assessment and decision: qualifying the incident and choosing a response.
Response: containment, eradication, recovery and communication.
Lessons learned: continuous process improvement.
Complements in the 27000 series
ISO/IEC 27037 covers digital evidence collection; ISO/IEC 27043 covers investigation; ISO/IEC 27041 covers investigation method assurance. Together they form a coherent ecosystem around incident response.