Learning from information security incidents

Plain-language summary

Using what incidents teach you — root causes, recurring patterns, costs and weaknesses in the response — to strengthen controls, update the risk assessment and the incident plan, and improve awareness, so the same incident does not happen twice.

What the clause is really asking

An incident that is closed and forgotten has cost you money and taught you nothing. This control asks you to use the knowledge gained from incidents to strengthen and improve your information security controls. In practice: a post-incident review for significant incidents, looking at what happened, why, how well the response worked and what should change; periodic analysis of the incident log for trends in types, volumes, costs and causes; and feeding the results into the risk assessment, control improvements, the incident response plan itself, and awareness training, where anonymised real cases teach better than generic ones. The common misunderstanding is that 'lessons learned' is a line on the closure form. Auditors look for change: a control added, a risk re-rated, a playbook updated. For an ISO 9001 practitioner this is familiar ground — root cause analysis and corrective action applied to security, and the same 5-why or 8D discipline works. Near misses count too: the phishing email nobody clicked still tells you what attackers are trying.

What auditors look for

Auditors ask for the post-incident reviews of significant incidents in the last year and follow each action to completion: was the control changed, the risk register updated, the playbook revised? They ask for any trend analysis of the incident log and whether management saw it at management review. They look for repeat incidents with the same cause, which suggests lessons were written but not applied. They check whether awareness material uses real cases. The hard question: name one thing you changed because of an incident, and show me the evidence that it worked.

Typical evidence

Post-incident review reports with root cause and actions; corrective action records linked to incidents; incident trend analysis by type, cause, volume and cost; risk assessment and treatment plan entries updated after incidents; revised incident procedures or playbooks; awareness material based on real incidents; management review inputs and outputs on incidents.

How to comply — recommendations

Hold a post-incident review within two weeks of every high or medium priority incident, using a one-page template: timeline, root cause (a 5-why is usually enough), what worked, what did not, and actions with owners and dates. Raise the actions in your existing corrective action system so they are tracked like any other nonconformity. Once a quarter, look at the incident log as a whole: counts by type and cause, repeat incidents, time to contain, estimated cost. Feed the summary into management review and the risk assessment. Turn one or two anonymised cases a year into awareness content.

Common nonconformities

No post-incident reviews for significant incidents; lessons recorded but no actions raised; actions from reviews not tracked to closure; repeat incidents with the same root cause; no trend analysis of incidents; risk assessment not updated after incidents; incident procedure unchanged despite weaknesses found in a real response; incident information absent from management review.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Article8D problem solving explained: the 8 disciplines, root cause analysis and a free template
• Toolkit · $29Incident & Breach Response KitWhen something happens the questions arrive faster than the facts: is it an incident, how bad, is it a POPIA breach, who must be told and by when, what do we write, what do we keep. This kit answers them in order.
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Toolkit · $298D Problem-Solving ToolkitThe full 8D method in one working workbook: a D0–D8 report with Is/Is-Not, the three-legged 5-Why and an Ishikawa canvas built in — you fill the fields, not the theory.
• Free masterclass · ~14 min8D Problem-Solving MasterclassAll nine disciplines D0–D8 in plain English — three-legged root cause analysis, Is/Is-Not, Ishikawa and the 5-Why, plus the mistakes that get 8D reports rejected.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.