ISO/IEC 27035 (information security incident management), explained

ISO/IEC 27035 is a multi-part International Standard, developed by ISO/IEC JTC 1/SC 27, on information security incident management. Per ISO's own catalogue, the current parts are: Part 1, "Principles and process" (ISO/IEC 27035-1:2023, 2nd edition, published 2023-02-13, 33 pages), which ISO describes as "the foundation of the ISO/IEC 27035 series," presenting "basic concepts, principles and process with key activities of information security incident management"; Part 2, "Guidelines to plan and prepare for incident response" (ISO/IEC 27035-2:2023, 2nd edition, also published 2023-02-13, 53 pages); Part 3, "Guidelines for ICT incident response operations" (ISO/IEC 27035-3:2020, 1st edition, published September 2020, 31 pages), which covers "information security incident detection, reporting, triage, analysis, response, containment, eradication, recovery and conclusion" and explicitly excludes "non-ICT incident response operations such as loss of paper-based documents"; and Part 4, "Coordination" (ISO/IEC 27035-4:2024, 1st edition, 22 pages), covering guidelines for organizations that must coordinate incident handling across multiple parties. Parts 1 and 2 superseded the 2016 editions of the same parts on their 2023-02-13 publication date, per ISO's catalogue withdrawal records; Part 3 has no prior edition, and Part 3 is separately flagged in ISO's catalogue as currently under review, so it has not yet been refreshed to match the 2023 revision of Parts 1-2. ISO/IEC 27035 is copyrighted; full text must be purchased from ISO, a national member body, or an authorized reseller — this guide summarizes publicly available catalogue and front-matter material rather than reproducing the operative text.

ISO/IEC 27035-1:2023's Clause 5 ("Process") sets out an information security incident management process built around five activity phases, after an initial overview sub-clause: 5.2 Plan and prepare, 5.3 Detect and report, 5.4 Assess and decide, 5.5 Respond, and 5.6 Learn lessons. ISO/IEC 27035-2:2023 explicitly anchors itself to two of those phases, stating in its own scope that it "provides guidelines to plan and prepare for incident response and to learn lessons from incident response," based on "the 'plan and prepare' and 'learn lessons' phases of the information security incident management phases model presented in ISO/IEC 27035-1:2023" (cited by 27035-2 to 27035-1 clauses 5.2 and 5.6 specifically). ISO/IEC 27035-3:2020's scope — covering detection, reporting, triage, analysis, response, containment, eradication, recovery and conclusion — corresponds in substance to the detect/assess/respond phases (5.3-5.5), though this guide did not find an explicit ISO cross-reference line tying Part 3's clauses to Part 1's phase numbers; treat that correspondence as inferred from the two parts' published scopes rather than a directly quoted ISO statement. Some secondary summaries render the phase names as noun phrases ("detection and reporting," "assessment and decision," "lessons learnt") rather than ISO's own verb-phrase clause titles quoted above — both describe the same five-phase model, but only the verb-phrase form reflects ISO's literal Clause 5 titles.

ISO/IEC 27035-1:2023 states its own relationship to the ISMS standards directly. Its Introduction says "the ISO/IEC 27035 series provides additional guidance to the controls on incident management in ISO/IEC 27002," and its Clause 4.2 adds that "another objective associated with this document is to provide guidance to organizations that aim to meet the information security management system (ISMS) requirements specified in ISO/IEC 27001 which are supported by guidance from ISO/IEC 27002," noting that "ISO/IEC 27001 includes requirements related to information security incident management" and that the standard's own Annex C provides "a cross-reference table on information security incident management clauses from ISO/IEC 27001 and clauses in this document." The specific ISO/IEC 27002:2022 controls this maps to are 5.24, "Information security incident management planning and preparation," and 5.26, "Response to information security incidents" — both titles taken from ISO/IEC 27002:2022's own table of contents. In short: ISO/IEC 27001 Annex A and ISO/IEC 27002 state *that* an ISMS must manage incidents and name the control titles; ISO/IEC 27035 is where the step-by-step process guidance for doing so actually lives. See our guide to [ISO/IEC 27001:2022](/guides/iso-iec-27001-isms-requirements/) for the ISMS clause structure and Annex A control themes this plugs into.

NIST's own incident-response guidance has recently moved past direct comparability: SP 800-61 Revision 2 ("Computer Security Incident Handling Guide," originally August 2012) was withdrawn by NIST on 3 April 2025 and superseded by SP 800-61 Revision 3, retitled "Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile" (April 2025) — a shift from a standalone incident-handling playbook to a profile mapped against the NIST Cybersecurity Framework 2.0. No ENISA, NIST or national-agency document found in this guide's research provides a formal phase-by-phase crosswalk between ISO/IEC 27035 and either NIST revision; comparisons of that kind exist mainly on vendor and compliance blogs, which this guide does not treat as authoritative. On EU law: ENISA's own Cyber Resilience Act Requirements Standards Mapping (JRC137340, 2024) does not mention ISO/IEC 27035 anywhere in its text. ENISA's June 2025 Technical Implementation Guidance on the NIS2 Directive's cybersecurity risk-management measures does name it, but only in supplementary footnotes to its Incident Handling section — footnote 18 states "the ISO/IEC 27035 series provides further guidance on incident management," citing ISO/IEC 27035-1:2023, and footnote 33 lists both ISO/IEC 27035-1:2023 and -2:2023 alongside NIST SP 800-61 Rev. 2 as material to "consider" in addition to ENISA's own normative mapping table. Neither footnote makes ISO/IEC 27035 a binding or presumption-of-conformity mechanism under NIS2 or the CRA — treat it as ENISA-endorsed supplementary guidance, not a named legal requirement.