A.5.25 A.5 · Organisational Controls

A.5.25 — Assessment and decision on information security events

Assess IS events and determine whether they should be classified as IS incidents.

Also written as A5.25, Annex A 5.25, ISO 27001:2022 A.5.25, ISO27001 A.5.25.

Written by Jett N. · Last reviewed

What ISO 27001 A.5.25 requires

Assessment and decision on information security events is one of 37 Organisational Controls in ISO/IEC 27001:2022 Annex A. Assess IS events and determine whether they should be classified as IS incidents. Organisational controls are judged on governance rather than tooling: an auditor wants a named owner, an approval trail, and evidence the control is exercised on a defined cadence rather than written once and filed.

Audit evidence assessors look for

When preparing your Statement of Applicability (SoA) for A.5.25, gather artefacts such as:

  • Incident classification procedure
  • SIEM or IS event log records
  • Triage and decision records for events
  • Escalation criteria and thresholds documentation

How A.5.25 maps to SOC 2 and NIST CSF

If you run more than one framework, the same evidence usually satisfies all of them. A.5.25 aligns with:

SOC 2: CC7.3 Security event evaluation

NIST CSF 2.0: DE.AE-02 Event analysis for indicators, DE.AE-04 Event impact and scope estimation, DE.AE-08 Incident declaration criteria, RS.MA-02 Incident report triage and validation, RS.MA-03 Incident categorization and prioritization

ISO 27001:2013 mapping

A.5.25 consolidates the following ISO 27001:2013 control(s): A.16.1.4. If you are transitioning an existing ISMS, map your prior evidence for these to A.5.25 in your updated SoA.

Map A.5.25 to NIST CSF & SOC 2 →
Crosswalk this control in the Control Mapper & Gap Assessment.
Document the risk →
Record treatment for gaps against A.5.25 in the Risk Register.

Related Annex A controls

A.6.8 Information security event reporting A.5.24 Information security incident management planning and preparation

See all 37 Organisational Controls →

Frequently asked questions

Is ISO 27001 A.5.25 mandatory?

Annex A controls are not mandatory in the abstract. Clause 6.1.3 requires you to compare your risk treatment plan against Annex A and justify, in the Statement of Applicability, any control you exclude. If your risk assessment surfaces a risk that A.5.25 addresses, excluding it needs a documented, risk-based rationale that an auditor will test.

How do auditors test ISO 27001 A.5.25?

In two passes. First design: does a documented control exist, is it owned, and does it address the risk? Then operating effectiveness: the auditor samples records from across the audit period to confirm the control actually ran. A Stage 2 audit will typically pull several samples, so evidence that only exists for the month before the audit is a common finding.

How often should A.5.25 be reviewed?

ISO 27001 sets no fixed interval — it requires review at "planned intervals" and after significant change. Annual review is the norm most certification bodies expect, with an out-of-cycle review triggered by incidents, major system changes, restructures, or new regulatory obligations. Record the review date and outcome either way; an undated control is treated as unreviewed.

What does ISO 27001 A.5.25 map to in SOC 2 and NIST CSF?

A.5.25 aligns with SOC 2 CC7.3 and NIST CSF DE.AE-02, DE.AE-04, DE.AE-08, RS.MA-02, RS.MA-03. Evidence gathered for one framework will usually satisfy the others, which is the basis for a test-once, satisfy-many control library.

What was A.5.25 in ISO 27001:2013?

A.5.25 consolidates 1 control(s) from the 2013 edition: A.16.1.4. When transitioning, re-point the existing evidence rather than rebuilding it — the underlying requirement has not changed materially.