ISO 27001 incident and continuity management: exercising and evidencing Annex A 5.24 to 5.30
What does ISO 27001 require for incident management and incident response?
ISO 27001 requires you to assess, handle and evaluate information security incidents according to defined procedures and to maintain information security even during a disruption. The details are governed by the seven controls A.5.24 to A.5.30 in Annex A of ISO/IEC 27001:2022. In the statement of applicability you justify which of them apply to your ISMS.
The standard wants to see effectiveness evidenced. An incident response plan that has never been exercised only evidences that a document exists. Only an exercise shows whether roles, escalation, reporting paths and decisions work under time pressure and where the plan has gaps. That is the evidence an auditor expects for ISO 27001 incident management.
Annex A 5.24 to 5.30: the controls at a glance
The following table paraphrases each control and shows what an exercise can evidence for it. The text of the standard is authoritative.
| Control | Title | What the control requires | What an exercise evidences |
|---|---|---|---|
| A.5.24 | Information security incident management planning and preparation | Define, establish and communicate processes, roles and responsibilities for incident management. | Roles are filled and known. Escalation and communication paths work under time pressure. |
| A.5.25 | Assessment and decision on information security events | Assess events and decide whether they are classified as information security incidents. | An unclear event is classified in a traceable way. Criteria, timing and decision-maker are in the log. |
| A.5.26 | Response to information security incidents | Respond to incidents in accordance with documented procedures. | The incident response plan and playbooks are applied, and deviations from the plan become visible. |
| A.5.27 | Learning from information security incidents | Use knowledge gained from incidents to strengthen and improve the information security controls. | After-action report and action plan show that findings are turned into improvements. |
| A.5.28 | Collection of evidence | Establish and implement procedures for the identification, collection, acquisition and preservation of evidence. | The team knows who secures evidence and when, for example before affected systems are rebuilt. |
| A.5.29 | Information security during disruption | Plan how to maintain information security at an appropriate level during disruption. | Emergency decisions such as workarounds or emergency operation are checked for their security consequences and not taken ad hoc. |
| A.5.30 | ICT readiness for business continuity | Plan, implement, maintain and test ICT readiness based on business continuity objectives. | Recovery order, RTO assumptions and dependencies are plausible. A functional test additionally evidences the technical implementation. |
For exercises, three controls matter most. A.5.24 defines who does what in an incident. The exercise checks whether these definitions hold in an incident. A.5.29 requires that security is not suspended in emergency operation either. A typical exercise question: does the quick workaround open new risks? A.5.30 names testing explicitly and connects the ISMS with business continuity management.
Which exercise format evidences which control?
Not every exercise evidences every control. Discussion-based formats check decisions and procedures, technical tests check recovery:
- Tabletop exercise (plan walkthrough or discussion-based crisis team exercise on a scenario): A.5.24 to A.5.27 and A.5.29. Roles, classification, response, escalation, communication and lessons learned are checked.
- Crisis team exercise with crisis team and management: A.5.24, A.5.26 and A.5.29. Leadership capability, situation briefings and decisions in emergency operation are checked.
- Alerting exercise: A.5.24. Whether the roles can be reached and the alerting chain works is checked.
- Functional test (e.g. restore or recovery test): A.5.30. Technical recovery within the planned times is checked.
An overview of all exercise formats with effort and purpose is in the article on the cyber tabletop exercise.
How often do you have to exercise under ISO 27001?
ISO 27001 prescribes no fixed exercise frequency. You set the frequency on a risk basis and justify it in the ISMS. The auditor asks for this justification, not for a number from the standard. In practice it has proven sensible to exercise every critical incident and continuity scenario at least once a year.
Further orientation comes from neighbouring frameworks:
- ISO 22301 (clause 8.5) expects an exercise programme with exercises at planned intervals and after significant changes.
- DORA requires financial entities to test their ICT business continuity, response and recovery plans at least yearly (Art. 11(6)).
- NIS2 requires policies and procedures to assess the effectiveness of the risk-management measures (Art. 21(2)(f)).
You should also exercise on specific occasions: after significant changes to the organisation, IT or service providers, after a real incident, and as soon as actions from the last exercise have been implemented. The exercise then serves as the effectiveness check. What an annual exercise plan with four exercises can look like is shown on the page for ISMS managers.
The 8 documents of audit-proof exercise evidence
A photo of the whiteboard and a participant list are not enough in the audit. Complete exercise evidence consists of eight documents that together evidence the chain from planning to improvement:
- Exercise brief and objectives: who commissioned the exercise and which risk or control it tests, with reference to the information security objectives (6.2).
- Scenario and scope: starting situation, assumptions, systems and sites included and areas deliberately excluded.
- Participants and roles: names, functions and exercise roles, including facilitation and observation.
- Exercise log with timestamps and decisions: injects, responses and decisions with reasoning and time.
- Observations/findings: strengths and gaps, phrased without judgement and mapped to the respective plan or control.
- After-action report: the evaluation of target against actual with causes and assessment, see after-action review.
- Action plan: every action with owner, deadline and priority.
- Evidence of implementation and effectiveness check: proof of implementation and a follow-up exercise showing that the gap has been closed.
Documents 1 to 5 evidence that the exercise took place. Documents 6 to 8 evidence that the organisation learns from it. That is what A.5.27 and clause 10 of the standard are about.
Which KPIs are suitable for exercises?
ISO 27001 prescribes no particular exercise metrics. Clause 9.1 (monitoring, measurement, analysis and evaluation) does require you to determine what you monitor and measure, with which methods, when and by whom. You must also evaluate the results. Exercise metrics fit well here because they make the effectiveness of incident management measurable. The following KPIs are examples, not requirements of the standard:
| KPI (example) | What it shows | Data source |
|---|---|---|
| Share of critical scenarios exercised per year | Coverage of the exercise programme against the risk assessment | Annual exercise plan, risk register |
| Time to escalation | How fast an event is assessed and escalated to the responsible function (A.5.25) | Exercise log with timestamps |
| Completion rate of actions within the deadline | Whether findings are also implemented (A.5.27, 10.2) | Action plan |
| Repeated findings | Whether the same gap appears again in a follow-up exercise. That points to ineffective corrective actions. | Comparison of findings across several exercises |
| Participation rate of the intended roles including deputies | Whether roles would actually be filled in a real incident | Participant list with roles |
You set the target values yourself and link them to your information security objectives under 6.2. Comparability matters. Collect the same KPIs across several exercises. Only then does a trend emerge that you can show in the management review.
Exercises in the internal audit, management review and corrective actions
Exercise results feed into three mandatory ISMS processes.
Internal audit (9.2)
Internal audits check at planned intervals whether the ISMS meets the requirements and is implemented effectively. With exercise evidence the auditor can check A.5.24 to A.5.30 against records, not only against documents. Include the exercise programme in the audit programme: the auditor picks an exercise and follows the chain from the exercise brief to the effectiveness check.
Management review (9.3)
The management review takes in, among other things, results of monitoring and measurement, audit results and the status of corrective actions. Exercise KPIs and open actions from exercises therefore belong in the material for management. The outcome is decisions on improvement, such as approving the exercise plan for the next year or resources for a repeatedly identified gap.
Nonconformity and corrective action (10.2)
Not every finding is a nonconformity. Sometimes, however, an exercise shows that a documented procedure does not work, such as a reporting path known to only one person. Then 10.2 requires you to react and to evaluate the cause. Corrective actions must be implemented, reviewed for effectiveness and documented. The follow-up exercise is the obvious evidence of effectiveness. All other findings feed into continual improvement under 10.1.
ISO 27001 and ISO 22301
ISO 27001 protects the information, ISO 22301 keeps the business processes running. The bridge between the two is A.5.30: ICT readiness follows the business continuity objectives. ISO 22301 requires its own exercise programme in clause 8.5. Anyone operating both standards does best to plan a joint exercise programme. A well-documented exercise can then deliver evidence for both management systems.
The tabletop exercise as evidence of effectiveness
In a tabletop exercise the team plays through a realistic incident. It makes decisions, escalates, communicates and works through the reporting chain. SecDrills follows the ENISA exercise methodology and assigns roles along the ECSF. SecDrills produces the auditable after-action report automatically, with participants, roles, decisions, timestamps and derived actions. A first exercise is possible from 30 minutes. It runs in the browser, and you do not need an external facilitator. Across several exercises you show how the maturity of your ISO 27001 incident and continuity management develops, backed by data from the reports.
Frequently asked questions
Does ISO 27001 require emergency exercises?
ISO/IEC 27001:2022 prescribes no particular exercise format but requires evidence that incident and continuity processes are effective. A.5.30 explicitly requires testing ICT readiness for business continuity. For A.5.24 to A.5.29, exercises are the most practical evidence of effectiveness. A tabletop exercise is a recognised way to do that.
How often do you have to exercise under ISO 27001?
The standard names no fixed frequency. You set it on a risk basis and justify it in the ISMS. Exercising every critical scenario at least once a year, plus after significant changes, has proven sensible. ISO 22301 expects exercises at planned intervals, and DORA requires financial entities to test their plans at least yearly.
Which ISO 27001 controls does a tabletop exercise cover?
Above all A.5.24 to A.5.27 (planning, assessment, response, learning) and A.5.29 (information security during disruption). It checks A.5.28 (evidence) at the procedural level. For A.5.30 it evidences the plausibility of the recovery planning; technical recovery is additionally evidenced with a functional test.
How does a tabletop exercise help in the ISO 27001 audit?
The auditor checks whether documented procedures are also effective. A documented exercise with exercise log, after-action report and a tracked action plan delivers this evidence. You can use it in the internal audit (9.2), in the management review (9.3) and as evidence for corrective actions (10.2).
What is the difference between A.5.29 and A.5.30?
A.5.29 concerns information security during a disruption: protective measures should remain at an appropriate level even in emergency operation. A.5.30 concerns ICT readiness: IT systems and services must be recoverable in line with the business continuity objectives, and that must be tested.
Note: This article is for general information and is not legal advice. The applicable laws and regulations, and the current state of national transposition, take precedence.