ISO 27035: managing information security incidents

ISO 27035 is the series of international standards on information security incident management: prepare, detect, assess, respond and learn lessons. It does not replace legal obligations, but it provides the framework that lets you meet them: NIS 2 requires an early warning within 24 hours, DORA a notification within a few hours, the GDPR a notification to the supervisory authority within 72 hours.

ISO/IEC 27035 belongs to the ISO/IEC 27000 family. Published jointly by ISO and the International Electrotechnical Commission (IEC), it now has four parts, all titled Information security incident management.

ISO 27035 distinguishes two notions. A security event is something you observe that may be relevant to security: an antivirus alert, a login at an unusual hour, a suspicious email reported by an employee. An incident is an event, or series of events, that has been established as harming, or being very likely to harm, information security.

Moving from one to the other does not happen by itself: it results from an assessment. As the ISO27k commentary puts it, events may be, or turn into, incidents, and they need to be examined to decide. This step avoids two opposite pitfalls: treating every alert as a crisis, which exhausts teams, or missing a real incident for lack of triage. It is also where you decide whether a regulatory notification is due.

The public table of contents of ISO/IEC 27035-1:2023 describes the process in five phases. The diagram below links them and shows the triage that happens at assessment: an alert with no follow-up leaves the flow, a confirmed incident goes all the way through and feeds lessons learned.

ISO 27035 is a voluntary standard: organisations are not certified against it. It is mainly used to implement ISO 27001's incident requirements. Annex A of ISO 27001:2022 contains a dedicated set of controls, listed by the certification body DQS: incident management planning and preparation (5.24), assessment and decision on events (5.25), response to incidents (5.26), learning from incidents (5.27) and collection of evidence (5.28). The ISO 27035 phases are recognisable almost word for word.

For an organisation building its information security management system, the combination is natural: ISO 27001 sets out what must exist, ISO 27035 describes how to organise it.

ISO 27035 sets no notification deadline: legislation does, and a single incident can trigger several.

• NIS 2. For a significant incident, Directive (EU) 2022/2555 provides, as presented by the European Commission, for an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours and a final report no later than one month after the notification, sent to the CSIRT or competent authority. These obligations apply through each member state's transposing law; in France, the transposing bill had not yet been passed in October 2026, as our article on the French resilience bill explains.
• DORA. For financial entities, Regulation (EU) 2022/2554 has applied since 17 January 2025. Delegated Regulation (EU) 2025/301 sets the time limits for a major information and communication technology (ICT) related incident: initial notification within 4 hours of classifying it as major, and no later than 24 hours after becoming aware of it; intermediate report within 72 hours of the initial notification; final report no later than one month after the latest intermediate report. Reports go to the relevant supervisory authority.
• GDPR. If the incident is a personal data breach that poses a risk to individuals, it must be notified to the supervisory authority (in France, the CNIL) without undue delay and, where feasible, within 72 hours of becoming aware of it, in several stages if necessary. Data subjects must be informed if the risk is high. Every breach, even if not notified, is documented internally.

The next diagram overlays these clocks for an incident that falls under all three regimes, for example an attack on a financial entity that exposes customer data.

• Write a short policy signed by management: scope, roles, severity criteria, escalation rules.
• Define a qualification grid that includes regulatory thresholds: significant incident under NIS 2, major incident under DORA, personal data breach under the GDPR.
• Keep a register of events and incidents, with timestamps for detection, qualification and notification.
• Prepare playbooks for the most likely scenarios: ransomware (see our article on ransomware entering through edge devices), email compromise, data leak.
• Keep offline emergency contacts, the system map and procedures.
• Run exercises at least once a year, then apply the fifth phase: fix what the exercise revealed.

Incident handling is one of the risk management measures NIS 2 requires of the entities it covers. To manage all these requirements, see our compliance campaigns module.