[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-26":3},{"item":4,"lessons":16,"controls":42,"related":70},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-26","Annex A 5.26","ISO\u002FIEC 27001:2022 Annex A 5.26: Response to information security incidents",6,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects information security incidents to be responded to in accordance with documented procedures. It is the response part of the incident management controls, following planning, assessment and decisions about events. Its purpose is to make the response to incidents efficient and effective.\n\n**In practice.** Good practice means procedures that cover containment, collecting evidence, escalation, communication with internal and external parties, recovery and closure. Responders know their roles and follow agreed steps, with legal and regulatory notification considered. Auditors expect documented procedures, incident records showing they were followed and post-incident reviews.\n\n**Common gaps.** Typical gaps are procedures that exist but are bypassed under pressure, poor documentation during incidents and no follow-up on lessons learned. Communication with customers, authorities and suppliers is often improvised rather than prepared, and coordination with external responders is not agreed in advance.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38],{"slug":19,"title":20,"published_at":21},"ahold-delhaize-hit-by-repeat-cyberattack-systems-taken-offline","Ahold Delhaize Hit by Repeat Cyberattack, Systems Taken Offline","2026-10-12T14:20:19.363+00:00",{"slug":23,"title":24,"published_at":25},"microsofts-x-account-hijacked-to-push-crypto-scam","Microsoft's X Account Hijacked to Push Crypto Scam","2026-10-02T12:20:21.468+00:00",{"slug":27,"title":28,"published_at":29},"kiteworks-proactive-shutdown-averts-critical-zero-day-exploitation","Kiteworks Proactive Shutdown Averts Critical Zero-Day Exploitation","2026-09-29T16:22:53.803+00:00",{"slug":31,"title":32,"published_at":33},"ransomware-hits-japanese-railway-giant-keio-disrupts-hospitality-payment-systems","Ransomware Hits Japanese Railway Giant Keio, Disrupts Hospitality Payment Systems","2026-09-28T22:20:40.912+00:00",{"slug":35,"title":36,"published_at":37},"ai-agent-circumvents-government-portal-access-controls-reporting-delay-compounds-risk","AI Agent Circumvents Government Portal Access Controls, Reporting Delay Compounds Risk","2026-09-24T10:21:28.2+00:00",{"slug":39,"title":40,"published_at":41},"ten-month-breach-of-south-koreas-diplomatic-academy-exposes-6000-staff-records","Ten-Month Breach of South Korea's Diplomatic Academy Exposes 6,000 Staff Records","2026-07-22T22:21:09.049+00:00",[43,48,53,57,61,65],{"slug":44,"name":45,"problem":46,"stories":47},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",4,{"slug":49,"name":50,"problem":51,"stories":52},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",2,{"slug":54,"name":55,"problem":56,"stories":52},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":58,"name":59,"problem":60,"stories":52},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":62,"name":63,"problem":64,"stories":52},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",{"slug":66,"name":67,"problem":68,"stories":69},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,[71,75,81,86,92,96,101,105],{"family":72,"item":73,"code":74,"title":74,"together":9},"itil","overview","ITIL",{"family":76,"item":77,"code":78,"title":79,"together":80},"gdpr","33","Article 33","Notification of a personal data breach to the supervisory authority",5,{"family":82,"item":83,"code":84,"title":85,"together":47},"cis","17","Control 17","Incident Response Management",{"family":87,"item":88,"code":89,"title":90,"together":91},"nist-sp","800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management",3,{"family":82,"item":93,"code":94,"title":95,"together":91},"12","Control 12","Network Infrastructure Management",{"family":97,"item":98,"code":99,"title":100,"together":91},"nist-800-53","ir-4","IR-4","Incident Handling",{"family":82,"item":102,"code":103,"title":104,"together":91},"3","Control 3","Data Protection",{"family":82,"item":106,"code":107,"title":108,"together":52},"6","Control 6","Access Control Management"]