Information security incident management effectiveness
Incident management effectiveness is measured by resolution against a target time.
What the published 2016 guidance says
Incident management effectiveness is measured by resolution against a target time. The construct defines incident categories and a target resolution time for each, sets thresholds for incidents that exceed the target, and compares the count with the thresholds. The target is to stay within the green band. Evidence is the monthly indicator report. It is collected, analysed and reported monthly and reviewed every six months. The management system leads own it, the incident management manager collects, and the management committee, security and incident teams are clients. A table and a trend diagram carry the result.
What it means in practice
Incident management effectiveness is measured by resolution against a target time per category. Define the categories and the thresholds first. The monthly table and trend diagram are more useful than an annual average, because incidents cluster.
Status of this record. For B.33, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Define the incident categories and the target resolution times. Keep the incident records and the monthly indicator. Report the table and the trend. Review the thresholds when the service or the threat changes.
Evidence an assessor asks for
- Incident managementIncident categories with target resolution times and thresholds
- Incident managementMonthly table of incidents exceeding target per category
- Incident managementTrend diagram
The question an assessor will ask
An assessor will ask for incident categories with target resolution times and thresholds. The test for B.33 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Resolution time not captured per incident
- Categories with no target, so nothing can exceed it
Before the next review
Before the next review, test this against one live record: resolution time not captured per incident.
What to check when the revision publishes
When DIS 27004 is published, compare the B.33 Information security incident management effectiveness record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.