You’re staring at a ransomware note. Or a customer just told you their data is on the dark web. What do you do? Panic? Blame someone? Freeze? No. You need a plan you’ve already rehearsed. That’s exactly what ISO 27035 Canada gives you. It’s the international standard for information security incident management—the step‑by‑step playbook for spotting, handling, and learning from security events. At A & T Global IT Consulting, we’ve helped Canadian businesses turn chaos into calm. Let’s walk through how you get certified, what real incident management looks like, and the exact process that saves your bacon when things go wrong.
ISO 27035 Certification
You can’t get “ISO 27035 certified” as a standalone badge. Wait, what? ISO 27035 certification isn’t like ISO 27001. This standard is guidance—not a management system you certify against. But here’s what matters: many ISO 27001 audits will check if you follow ISO 27035 principles for incident response. So while you don’t get a separate certificate, your ISO 27001 auditor will expect to see ISO 27035 in your processes.
What Actually Gets Certified?
You can earn a PECB Certified ISO/IEC 27035 Lead Incident Manager credential. That’s a personal certification that proves you know how to build and run an incident management program using the standard. At A & T, we offer that training. Many Canadian compliance managers add this to their resume to stand out. For your company, the win is aligning with ISO 27035 so your next ISO 27001 audit has zero findings in the incident management clause (A.16).
Common Mistake People Make at the Desk
They write an incident response plan, print it, stick it in a binder, and never test it. Then a real incident happens at 6 PM on a Friday. Nobody remembers where the binder is. What you should bring to the table: a laminated one‑page cheat sheet with phone numbers, the first three steps, and a “who decides what” flowchart. Tape it under everyone’s keyboard. We hand these out to every client.
Information Security Incident Management
Information security incident management is the whole system you build to handle security events—from a suspicious email to a full‑blown breach. ISO 27035 breaks it into four phases: Plan & Prepare, Detection & Reporting, Assessment & Decision, and Response & Lessons Learned. Most companies skip the first phase. That’s like buying a fire extinguisher but never teaching anyone how to pull the pin.
Element Nobody Talks About
You’ll have technical steps (isolate the server, capture logs, change passwords). But the hardest part is people. Who calls the CEO? Who talks to the lawyer? Who tells customers? ISO 27035 forces you to assign these roles ahead of time. Real example: a Toronto e‑commerce company had a breach at 11 PM. Their plan said “notify the incident manager.” That manager was on vacation in Europe. No backup. We fixed that by requiring two deputy managers for every shift. Simple fix. Saves careers.
Information Security Incident Management Process
The information security incident management process is your drumbeat. ISO 27035 gives you a loop: detect, triage, respond, recover, review. You run this loop every single time something weird happens—even false alarms. Why? Because practice builds muscle memory.
Step‑by‑Step Breakdown
- Detection: Someone reports a weird login from another country. Your SIEM tool (security monitoring software) fires an alert.
- Triage: You decide if it’s an event (just odd) or an incident (needs action). A single failed login is an event. Ten failed logins in one minute is an incident.
- Containment: Cut off the attacker. Disable the user account, block the IP, take the server offline.
- Eradication: Remove the bad stuff. Scan for malware, delete backdoors, patch the hole.
- Recovery: Bring systems back from clean backups. Test everything first.
- Lessons Learned: Write down what went wrong and what went right. Change your plan so it doesn’t happen again.
Biggest mistake: skipping lessons learned because you’re tired. That’s when you repeat the same breach next quarter. Block two hours on the calendar the day after any incident.
Information Security Incident Management Procedure
Your information security incident management procedure is the written document that tells every employee exactly what to do. Keep it short. ISO 27035 doesn’t require 50 pages. Here’s what a good procedure includes:
- Who to call (primary and backup, with cell numbers)
- How to report (a simple email address like incident@yourcompany.com, plus a phone hotline)
- What to do immediately (unplug the network cable? Take a photo of the error message? Save the log?)
- What NOT to do (don’t shut down the server before capturing memory, don’t delete suspicious emails)
- Escalation rules (if customer data is involved, call the privacy officer within one hour)
We give clients an information security incident management procedure example template that fits on four pages. You customize the names and numbers. Done in half a day.
Information Security Incident Management Software
You don’t need fancy tools for small teams. A shared spreadsheet and a group chat work fine for starters. But once you have more than five incidents a month, information security incident management software saves you from chaos. Tools like TheHive (free, open‑source), Jira Service Management (with incident module), or PagerDuty help you track tickets, assign tasks, and measure response times. What we recommend: start with a simple ticketing system in your existing helpdesk. Add a dedicated tool when you hit 50+ employees. We’ve seen a Vancouver startup use Slack plus a Google Form successfully for two years.
Why A & T Global IT Consulting Is Your Go‑To for ISO 27035 Canada
You could read the 80‑page standard yourself. But turning it into a plan that your team actually follows when the CEO is screaming? That’s our specialty. Here’s what you get with us:
- Real‑world incident templates – We’ve handled ransomware, phishing campaigns, lost laptops, and even a disgruntled ex‑employee who deleted SharePoint. Our procedure examples come from actual Canadian incidents.
- Tabletop exercises that don’t suck – We run two‑hour simulated breaches with your team. You’ll laugh, you’ll argue, and you’ll walk out with a fixed plan. No boring PowerPoints.
- One‑page cheat sheets – Mentioned earlier. We laminate them for you. Hang them in your server room, your IT closet, and by the coffee machine.
- PECB‑certified training – Our ISO 27035 Lead Incident Manager course is packed with real case studies. You’ll learn by doing, not memorizing. Check our PECB ISO training page for dates.
- Fixed‑fee incident readiness assessment – We’ll review your current plan (or lack of one) and hand you a punch list of fixes within one week. No hourly billing, no surprises.
Most common human error we fix: companies assign incident roles based on job titles, not availability. Your CISO might be great, but she’s asleep at 2 AM. We help you build a rotating on‑call schedule that works for real people.
Frequently Asked Questions
What is information security incident management?
It’s the structured process your organization uses to detect, contain, recover from, and learn about security incidents—like breaches, malware infections, or unauthorized access. Think of it as your emergency room playbook for cyber events.
Information security incident management guideline
ISO 27035 is the primary international guideline. It provides a four‑phase framework: plan & prepare, detect & report, assess & decide, respond & learn. You don’t have to follow it exactly, but every auditor knows it.
Information security incident management procedure example
A simple example: Step 1 – Employee calls 555‑INCIDENT. Step 2 – On‑call analyst triages within 15 minutes. Step 3 – If a confirmed incident, isolate the affected system. Step 4 – Notify the manager. Step 5 – Restore from backup. Step 6 – File a lesson‑learned report within 48 hours.
Do I need ISO 27035 certification for my company?
Your company can’t get certified to ISO 27035, but your incident manager can earn a personal PECB credential. More importantly, following ISO 27035 is required by ISO 27001 Clause A.16. So yes, you need to implement it.
How long does it take to build an ISO 27035‑aligned incident plan?
With our templates and a focused afternoon, you can have a draft procedure in four hours. Then another two hours for a tabletop exercise to test it. Most of our clients are fully ready within two weeks.
What’s the difference between an event and an incident?
An event is any observable occurrence in your system (a log entry, a failed login). An incident is an event that actually harms or threatens to harm your information security. All incidents are events, but not all events are incidents.
Can I use free software for incident management?
Yes. For small teams, a shared spreadsheet with columns (date, reporter, description, severity, status, closure notes) works fine. Free tools like TheHive or even a Trello board with incident labels are great. Start simple, upgrade when you feel pain.
What should I do in the first 10 minutes of an incident?
- Don’t panic. 2. Write down the time. 3. Take a screenshot or photo of any error messages. 4. Disconnect the affected computer from the network (unplug the cable or disable Wi‑Fi). 5. Call your incident response lead. That’s it. Don’t try to be a hero.
