[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-24":3},{"item":4,"lessons":16,"controls":30,"related":49},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-24","Annex A 5.24","ISO\u002FIEC 27001:2022 Annex A 5.24: Information security incident management planning and preparation",3,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects the organisation to plan and prepare for managing information security incidents by defining, establishing and communicating incident management processes, roles and responsibilities. Its purpose is to make the response to incidents quick, effective, consistent and orderly, including communication about events.\n\n**In practice.** Good practice means a documented incident management process covering reporting, assessment, response and learning, with named roles, escalation routes and contact lists including external parties. Training and exercises prepare responders, and regulatory notification duties such as those under NIS2 or DORA are built in. Auditors expect the plan, role assignments, exercise records and evidence that the process is communicated.\n\n**Common gaps.** Typical gaps are plans that do not include regulatory reporting deadlines, untested procedures and no arrangements with external responders before they are needed.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26],{"slug":19,"title":20,"published_at":21},"eu-cyber-resilience-act-activates-mandatory-vulnerability-reporting","EU Cyber Resilience Act Activates Mandatory Vulnerability Reporting","2026-10-01T12:20:17.746+00:00",{"slug":23,"title":24,"published_at":25},"24m-gdpr-fine-for-genomics-firm-over-weak-security-controls-and-late-breach-notification","€2.4M GDPR Fine for Genomics Firm Over Weak Security Controls and Late Breach Notification","2026-07-29T12:21:11.883+00:00",{"slug":27,"title":28,"published_at":29},"polish-municipality-fined-for-failing-to-report-gdpr-data-breach","Polish Municipality Fined for Failing to Report GDPR Data Breach","2026-06-16T19:22:50.95+00:00",[31,36,41,45],{"slug":32,"name":33,"problem":34,"stories":35},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",2,{"slug":37,"name":38,"problem":39,"stories":40},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",1,{"slug":42,"name":43,"problem":44,"stories":40},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":46,"name":47,"problem":48,"stories":40},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[50,55,60,65,69,74,78,83],{"family":51,"item":52,"code":53,"title":54,"together":9},"cis","17","Control 17","Incident Response Management",{"family":56,"item":57,"code":58,"title":59,"together":9},"gdpr","33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":61,"item":62,"code":63,"title":64,"together":35},"nist-sp","800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management",{"family":56,"item":66,"code":67,"title":68,"together":35},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":70,"item":71,"code":72,"title":73,"together":35},"nist-800-53","ir-6","IR-6","Incident Reporting",{"family":56,"item":75,"code":76,"title":77,"together":40},"25","Article 25","Data protection by design and by default",{"family":79,"item":80,"code":81,"title":82,"together":40},"eu-cra","overview","Article 11","Cyber Resilience Act (Regulation (EU) 2024\u002F2847)",{"family":51,"item":66,"code":84,"title":85,"together":40},"Control 5","Account Management"]