What it covers. A multi-part international standard on information security incident management. It covers principles and the process, guidelines for planning and preparing for incident response, and guidance on incident response operations, with a structured approach from preparation through detection, assessment, response and lessons learned.
In practice. Organisations define an incident management policy, set up a response team with clear roles, agree categories and severity levels, and establish reporting channels for staff and third parties. Response procedures cover containment, evidence handling, communication and recovery, and post-incident reviews feed improvements. Evidence includes plans, incident records, exercise results and tracked actions.
Common gaps. Organisations often have a plan that is not exercised, unclear criteria for when an event becomes an incident, and poor coordination with suppliers and regulators.