For Annex A controls 5.24 to 5.26, keep an incident plan, a record of how each event was assessed, and a response timeline with owners. Ticket history, chat exports and post incident notes can serve as evidence, as long as they are dated, linked and show decisions, not just activity.
Three controls, one flow
In the 2022 edition of Annex A these three controls follow each other:
| Control | Title | Question it answers |
|---|---|---|
| 5.24 | Information security incident management planning and preparation | Do we have a plan and roles? |
| 5.25 | Assessment and decision on information security events | How do we decide an event is an incident? |
| 5.26 | Response to information security incidents | What did we do about it? |
They are followed by 5.27 "Learning from information security incidents" and 5.28 "Collection of evidence". Treat the five as a pipeline: plan, decide, respond, learn, preserve.
Artifacts for each step
For planning, keep the incident response plan, the on call roster, the severity scale and the contact list, each with a review date. For assessment, keep the triage notes: what was reported, who looked, what criteria they applied and the decision. A ticket with a severity field and a short rationale does the job.
For response, a timeline is the strongest single artifact. It lists times for detection, triage, containment, fix and closure, with the person responsible for each. Chat exports help fill gaps, but a chat log on its own is hard to read, so write a summary that links to it.
For learning, a post incident review with actions, owners and due dates, and evidence the actions closed.
Practice with a low stakes event
You do not need a major breach to produce good evidence. A leaked test credential, a misconfigured storage bucket found internally or a failed deployment that exposed data briefly are all events worth running through the process.
- Open a ticket the moment the event is noticed.
- Record the triage decision and why.
- Add the timeline as work proceeds.
- Hold a short review within a week and write the actions.
- Close actions with links to the changes made.
Run a tabletop exercise once or twice a year as well, and keep the scenario, attendees and findings. Exercises count as evidence of preparation.
Pitfalls
Incidents handled in private chat with no ticket. Severity scales that nobody has used. Reviews that blame people instead of fixing causes. Records that differ from what customers or regulators were told. If you have notification duties from contracts or law, check your own obligations with counsel, since this post covers evidence format, not legal timing.
Where Safeguard fits
Safeguard offers compliance and evidence automation alongside SBOM and dependency scanning, which can help you collect dated records in one place. You can try the free scan at gold.safeguard.sh/scan. The decision on whether evidence is sufficient stays with your assessor.
Quick check
Do near misses count?
They are useful practice and good evidence of a working process, particularly in an organization that has had few real incidents.
Can chat logs be the only record?
They are risky as the sole record because they are long and unstructured. Summarize decisions in a ticket and link the chat.
Sources
- ISO 27001 Annex A controls list, Security Compliance Guide
- ISO 27001 Annex A controls explained, Glocert International
Last reviewed: 19 October 2026.
