Learning from information security incidents
The question is whether incidents produce change.
What the published 2016 guidance says
The question is whether incidents produce change. The construct counts the incidents that led to an improvement action and divides by all incidents, with a threshold the organization sets. The evidence is the action plan linked to each incident. It is collected quarterly and reported each semester. The incident response team owns the information, the security manager collects and is the client, and the data is the incident reports. As printed, the reporting format repeats the column chart from B.8, which the held copy records as a duplication.
What it means in practice
The question is whether an incident changed anything. Count the incidents that triggered an improvement action against all incidents. A low ratio is not automatically bad, but it needs an explanation: either the incidents were trivial or the learning loop is not closing.
Status of this record. For B.9, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Link each incident to the improvement action it triggered. Count the linked incidents against all incidents. Report the ratio with the action status, so a low ratio can be explained rather than assumed.
Evidence an assessor asks for
- Incident managementAction plan entries that cite the triggering incident
- ImprovementIncident reports with a follow-up action field
The question an assessor will ask
An assessor will ask for action plan entries that cite the triggering incident. The test for B.9 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Incidents closed with no improvement action recorded
- Actions raised but not linked back to the incident that caused them
Before the next review
Before the next review, test this against one live record: incidents closed with no improvement action recorded.
What to check when the revision publishes
When DIS 27004 is published, compare the B.9 Learning from information security incidents record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.