[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso\u002F27035":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso","27035","ISO\u002FIEC 27035","ISO\u002FIEC 27035: Information security incident management",103,"International Organization for Standardization (ISO) and IEC","**What it covers.** A multi-part international standard on information security incident management. It covers principles and the process, guidelines for planning and preparing for incident response, and guidance on incident response operations, with a structured approach from preparation through detection, assessment, response and lessons learned.\n\n**In practice.** Organisations define an incident management policy, set up a response team with clear roles, agree categories and severity levels, and establish reporting channels for staff and third parties. Response procedures cover containment, evidence handling, communication and recovery, and post-incident reviews feed improvements. Evidence includes plans, incident records, exercise results and tracked actions.\n\n**Common gaps.** Organisations often have a plan that is not exercised, unclear criteria for when an event becomes an incident, and poor coordination with suppliers and regulators.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F78973.html","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"mssps-must-shift-left-proactive-threat-hunting-is-the-new-ransomware-defense","MSSPs Must Shift Left: Proactive Threat Hunting Is the New Ransomware Defense","2026-10-13T12:20:17.419+00:00",{"slug":23,"title":24,"published_at":25},"ahold-delhaize-disconnects-systems-after-repeat-cyberattack","Ahold Delhaize Disconnects Systems After Repeat Cyberattack","2026-10-13T10:20:19.073+00:00",{"slug":27,"title":28,"published_at":29},"ransomware-negotiator-arrested-for-extortion-insider-threat-within-cybersecurity-industry","Ransomware Negotiator Arrested for Extortion: Insider Threat Within Cybersecurity Industry","2026-10-12T22:20:50.499+00:00",{"slug":31,"title":32,"published_at":33},"ransomware-recovery-firm-ceo-charged-with-defrauding-victims-while-secretly-paying-attackers","Ransomware Recovery Firm CEO Charged with Defrauding Victims While Secretly Paying Attackers","2026-10-09T20:20:24.799+00:00",{"slug":35,"title":36,"published_at":37},"ransomware-recovery-firm-ceo-indicted-for-secretly-paying-hackers-and-defrauding-clients","Ransomware 'Recovery' Firm CEO Indicted for Secretly Paying Hackers and Defrauding Clients","2026-10-08T20:20:23.319+00:00",{"slug":39,"title":40,"published_at":41},"ransomware-recovery-firm-charged-with-secretly-paying-ransoms-while-billing-victims-19m","Ransomware Recovery Firm Charged With Secretly Paying Ransoms While Billing Victims $19M+","2026-10-08T10:22:14.978+00:00",{"slug":43,"title":44,"published_at":45},"ransomware-recovery-firm-defrauded-victims-by-secretly-paying-ransoms","Ransomware Recovery Firm Defrauded Victims by Secretly Paying Ransoms","2026-10-08T00:20:18.733+00:00",{"slug":47,"title":48,"published_at":49},"shinyhunters-arrest-highlights-threat-of-organized-cybercriminal-groups-targeting-corporate-data","ShinyHunters Arrest Highlights Threat of Organized Cybercriminal Groups Targeting Corporate Data","2026-10-03T22:20:23.44+00:00",{"slug":51,"title":52,"published_at":53},"zero-day-response-failures-kiteworks-citrix-highlight-communication-gaps","Zero-Day Response Failures: Kiteworks & Citrix Highlight Communication Gaps","2026-10-02T18:21:29.731+00:00",{"slug":55,"title":56,"published_at":57},"teen-alleged-to-lead-killsec-ransomware-gang-behind-500-victims","Teen Alleged to Lead KillSec Ransomware Gang Behind 500 Victims","2026-10-01T22:20:19.419+00:00",{"slug":59,"title":60,"published_at":61},"killsec-extortion-group-dismantled-in-10-country-operation","KillSec Extortion Group Dismantled in 10-Country Operation","2026-10-01T20:20:32.296+00:00",{"slug":63,"title":64,"published_at":65},"metamask-infrastructure-incident-forces-emergency-validator-exits","MetaMask Infrastructure Incident Forces Emergency Validator Exits","2026-10-01T06:20:34.33+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",25,{"slug":73,"name":74,"problem":75,"stories":76},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",22,{"slug":78,"name":79,"problem":80,"stories":81},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",18,{"slug":83,"name":84,"problem":85,"stories":86},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",12,{"slug":88,"name":89,"problem":90,"stories":91},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",11,{"slug":93,"name":94,"problem":95,"stories":96},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",10,[98,104,110,116,121,125,130,135],{"family":99,"item":100,"code":101,"title":102,"together":103},"nist-800-53","ir-4","IR-4","Incident Handling",66,{"family":105,"item":106,"code":107,"title":108,"together":109},"nist-sp","800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management",45,{"family":111,"item":112,"code":113,"title":114,"together":115},"cis","17","Control 17","Incident Response Management",43,{"family":117,"item":118,"code":119,"title":119,"together":120},"itil","overview","ITIL",27,{"family":111,"item":122,"code":123,"title":124,"together":71},"13","Control 13","Network Monitoring and Defense",{"family":126,"item":127,"code":128,"title":129,"together":71},"gdpr","33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":111,"item":131,"code":132,"title":133,"together":134},"12","Control 12","Network Infrastructure Management",24,{"family":111,"item":136,"code":137,"title":138,"together":139},"11","Control 11","Data Recovery",23]