Question group
Incident and continuity
What happens when something goes wrong: the incident plan, how fast the customer hears about it, and how the service is recovered. The section where customers most often ask for a clock.
The families
4 families| Family and a typical question | ISO 27001 | Evidence expected |
|---|---|---|
| Incident response planDo you have a documented incident response plan, and when was it last tested? | 5.24, 5.26 | The incident response plan with roles and escalation, the record of the last test or tabletop exercise, and a closed incident record as a sample. |
| Notifying the customer of an incidentDescribe your process for notifying customers of a security incident, including timeframes. | 5.24, 5.25, 5.26 | The customer notification procedure with its clock, the named contact route, and the contract clause that fixes the period. |
| Business continuity planDo you have a documented business continuity plan tested at least annually? | 5.29, 5.30 | The continuity plan covering the service, the business impact analysis behind it, and the report of the last exercise with its actions. |
| Backup and disaster recoveryHow often are backups taken, and when was a restore last tested? | 8.13 | The backup schedule and retention, where backups are held and how they are protected, and the record of the last restore test with its result. |