A.5.25Assessment and decision on information security events
Assess security events and decide which ones are actual incidents that need a response. A consistent triage process stops real problems getting lost in the noise.
Mapping at a glance
A.5.25Assessment and decision on information security eventsISO/IEC 27001:2022
What an auditor, or Sekit's evidence engine, asks for.
Incident response plan
The plan defining how the company acts when a security incident occurs: who does what, who is notified, and within what timeframes.
Logging and monitoring configuration
How the company collects and keeps activity logs from its systems, and how security alerts are generated and handled.
From the Sekit evidence catalog
In practice
Most alerting tools generate more noise than signal, so this control is really about the triage step: does someone look at every alert within a defined time, decide whether it is a real security event, and escalate accordingly. Auditors want to see alert prioritization rules, not only an intrusion detection system running silently. A common failure is a SIEM or EDR that fires alerts nobody reads, with the queue only checked after a client asks about unusual login activity. Tuning out recurring false positives is what keeps a small team from missing a real signal buried under routine noise.
Common gaps
Security alerts route to a shared inbox that nobody monitors outside business hours, so weekend and holiday activity goes unreviewed for days.
The alerting tool keeps generating false positives that nobody has tuned out, so real signals get lost in the noise the team has learned to ignore.
There is no documented severity scale, so every alert gets the same response time regardless of whether it is a failed login or active malware.
Questions your auditor will ask
How quickly is a security alert reviewed after it fires?
The alert triage policy sets response windows by severity, and the monitoring tool timestamps when each alert was acknowledged against that target.
How do you decide an event is a genuine incident and not noise?
Analysts follow a documented triage process that classifies each alert by severity and confirms whether it meets the criteria for declaring an incident.
Who is responsible for reviewing alerts outside office hours?
The alerting configuration routes overnight and weekend alerts to an on-call rotation with defined escalation if nobody acknowledges within the target window.
Where regulation demands it
NIS2 3.4 requires a formal process for assessing and classifying security events before deciding whether they are incidents.
ENS op.mon.1 requires intrusion detection capability, which is the technical backbone this control's triage process relies on.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.