{"id":10176,"date":"2016-09-05T15:13:11","date_gmt":"2016-09-05T15:13:11","guid":{"rendered":"https:\/\/multiacademstg.wpengine.com\/27001academy\/?p=10176"},"modified":"2025-03-07T16:27:01","modified_gmt":"2025-03-07T16:27:01","slug":"incidents-in-iso22301-vs-iso27001-vs-iso-20000-vs-iso28003","status":"publish","type":"post","link":"https:\/\/staging.advisera.com\/27001academy\/blog\/2016\/09\/05\/incidents-in-iso22301-vs-iso27001-vs-iso-20000-vs-iso28003\/","title":{"rendered":"Incidents in ISO 22301 vs. ISO 27001 vs. ISO 20000 vs. ISO 28003"},"content":{"rendered":"<p>Management system standards, especially those dealing with security and interruptions of business processes, use the term \u201cincident management.\u201d As these management system standards deal with different aspects of managing business processes (IT Service Management, Information Security, Business Continuity, Supply Chain Security, and possibly others), the term is widely used but possesses a different meaning, depending on the context. On top of that, many of the standards also use the term \u201cevent.\u201d<\/p>\n<h2>From Events to Incidents<\/h2>\n<p>In order to simplify things, let us try to explain the relationship between \u201cevent\u201d and \u201cincident,\u201d ISO\/IEC Guide 73 (an ISO risk management vocabulary) defines an event as an \u201coccurrence that would change a particular set of circumstances.\u201d As this is not clear, <a href=\"https:\/\/staging.advisera.com\/27001academy\/what-is-iso-22301\/\" target=\"_blank\" rel=\"noopener noreferrer\">ISO 22301:2012<\/a> uses as many as four notes in order to better explain the definition of an event. The authors of this definition probably thought of events as being a kind of (sudden) change without a negative outcome. For example, an event may not have negative implications at all \u2013 something just changes (e.g., one out of three air conditioning packs is switched off because of maintenance).<\/p>\n<p>As such, the term \u201cevent\u201d might be used as a neutral expression. \u201cIncidents,\u201d on the contrary, might possess a negative meaning, according to their definition in different ISO standards. For example, if the switching off of the third air conditioning pack immediately overloads and shuts down the remaining two packs, the event developed into an incident.<\/p>\n<p>Find more explanations of the standards\u2019 terminology in the article <a href=\"https:\/\/staging.advisera.com\/27001academy\/blog\/2015\/01\/12\/explanation-of-the-basic-terminology-in-iso-standards\/\">Explanation of the basic terminology in ISO standards<\/a>.<br \/>\n<div id=\"middle-banner\" class=\"banner-shortcode\"><\/div><script>loadMiddleBanner();<\/script><br \/>\n<div id=\"side-banner-trigger\" class=\"banner-shortcode\"><\/div><\/p>\n<h2>Incidents in IT Service Management<\/h2>\n<p>The <a href=\"https:\/\/staging.advisera.com\/20000academy\/what-is-iso-20000\/\" target=\"_blank\" rel=\"noopener noreferrer\">ISO\/IEC standard on IT Service Management (ISO\/IEC 20000-1:2011)<\/a>, in its definition 3.10, underlines the two faces of incidents. While there are certainly incidents that are connected to an unplanned interruption to a service (negative impact to one or more users), an indication that one of the hard drives of an array of mirrored disks has developed a fault might be a kind of incident without an immediate negative impact, according to the above definition: \u201c\u2026 a reduction in the quality of service \u2026 that has not yet impacted the service to the customer.\u201d However, in IT service management, incidents are being connected to interruptions or a reduction in the quality of services to users. These incidents need to be taken care of by a properly set up incident management structure.<\/p>\n<p>Also, ISO 20000 considers, in addition to \u201cnormal\u201d incidents, so-called information security incidents. As mentioned in definition 3.12: \u201c\u2026 unexpected security events \u2026 significant probability \u2026 threatening information security.\u201d \u00a0These are incidents that are directly related to security issues, in contrast to incidents which, for example, are related to system interruptions.<\/p>\n<p>We need to remember that not all incidents in IT service management are security related. For example, the loss of a printing capability is an incident, but might not be related to security issues.<\/p>\n<h2>Incidents in Information Security<\/h2>\n<p>ISO\/IEC 27000:2016, in its definition 2.36 (information security incident), underlines the impact on business operations with respect to information security. As such, all three dimensions of information security: confidentiality, integrity, and availability \u2013 might be affected. For example, confidential documentation might have become exposed, malware might have corrupted data, or systems might have been put out of operation due to a cyber-attack.<\/p>\n<p>In order to deal with these types of incidents, an information security incident management structure needs to be in place. <a href=\"https:\/\/staging.advisera.com\/27001academy\/iso-27001-22301-premium-documentation-toolkit\/?rel=risk-management&amp;doc=statement-of-applicability\" target=\"_blank\" rel=\"noopener\">Annex A<\/a> of <a href=\"\/27001academy\/what-is-iso-27001\/\" target=\"_blank\" rel=\"noopener noreferrer\">ISO\/IEC 27001:2013<\/a> calls for such a structure in section A.16. It also lists a number of controls that need to be in place.<\/p>\n<p>See also the article <a href=\"\/27001academy\/blog\/2015\/10\/26\/how-to-handle-incidents-according-to-iso-27001-a-16\/\">How to handle incidents according to ISO 27001 A.16<\/a> to learn more about security incidents.<\/p>\n<h2>Incidents in Security Management for the Supply Chain<\/h2>\n<p>In the family of standards for security management for the supply chain, incident management is also of importance. For example, ISO 28003:2007 (governing the certification of supply chain security management systems) even asks auditors to know how to respond to security incidents.<\/p>\n<h2>Incidents in Business Continuity and Resilience<\/h2>\n<p>ISO 22301:2012, in its definition 3.19, which is based on ISO 22300:2012, clearly puts a negative interpretation on the definition of an <a href=\"https:\/\/staging.advisera.com\/27001academy\/iso-27001-22301-premium-documentation-toolkit\/?rel=information-security-controls&amp;doc=incident-log\" target=\"_blank\" rel=\"noopener\">incident<\/a>. The authors use the expression \u201cdisruptive incident\u201d in many parts of the standard. This is to underline that in business continuity, serious consequences may develop as results of business disruptions. The consequences might be much graver as compared to typically smaller incidents in IT service management.<\/p>\n<p>Typical consequences of these types of disruptive incidents \u2013 according to this definition \u2013 are process disruptions, losses of human life and assets, emergencies, or crises. Disruptions might have a wide range of causes and might not just impact information technology assets, but any assets of the organization. Essentially, business continuity prepares for such <a href=\"https:\/\/staging.advisera.com\/27001academy\/iso-27001-22301-premium-documentation-toolkit\/?rel=information-security-controls&amp;doc=incident-management-procedure\" target=\"_blank\" rel=\"noopener\">incidents<\/a>\u00a0(which might develop into full-blown emergencies) and to properly react to disruptions. Like with an ISMS, organizations might become certified against the requirements of ISO 22301:2012.<\/p>\n<h2>Be aware of the context<\/h2>\n<p>Mostly, \u201cincidents\u201d carry a negative meaning, but this is not always the case. Also, every definition is a compromise and may not exactly describe the term to be defined. As such, we need to be actively aware of the context we are operating in.<\/p>\n<p>For example, take the three standards ISO 22301, ISO 27001, and ISO 20000. If you have started with one of these frameworks and have learned to interpret the definition of an \u201cincident\u201d in the specific context of one framework, you need to understand that the definition of an \u201cincident\u201d in another ISO standard might be somewhat different. Maybe you need to more precisely specify the type of incidents by introducing and using terms like \u201cdisruptive incident,\u201d \u201cinformation security incident,\u201d and \u201cIT service management incident\u201d to avoid ambiguities.<\/p>\n<p>We have to live with approximations, and need to engage in a dialogue. This blog post serves to initiate such a dialogue.<\/p>\n<p><em>To implement ISO 27001 &amp; ISO 22301 easily and efficiently, use our <\/em><a href=\"https:\/\/staging.advisera.com\/27001academy\/iso-27001-22301-premium-documentation-toolkit\/\" target=\"_blank\" rel=\"noopener\">ISO 27001 &amp; ISO 22301 Premium Documentation Toolkit<\/a><em> that provides step-by-step guidance and all documents for full ISO 27001 &amp; ISO 22301 compliance.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Management system standards, especially those dealing with security and interruptions of business processes, use the term \u201cincident management.\u201d As these management system standards deal with different aspects of managing business processes (IT Service Management, Information Security, Business Continuity, Supply Chain Security, and possibly others), the term is widely used but possesses a different meaning, depending &#8230;<\/p>\n","protected":false},"author":45,"featured_media":10177,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[378,379,380,381,472,496,903,1464,1465,1466],"class_list":["post-10176","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-business-continuity","tag-information-security","tag-iso-22301","tag-iso-27001","tag-iso-20000","tag-bcms","tag-incident-management","tag-iso-27000","tag-event","tag-it-service-management"],"acf":[],"_links":{"self":[{"href":"https:\/\/staging.advisera.com\/27001academy\/wp-json\/wp\/v2\/posts\/10176","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/staging.advisera.com\/27001academy\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/staging.advisera.com\/27001academy\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/staging.advisera.com\/27001academy\/wp-json\/wp\/v2\/users\/45"}],"replies":[{"embeddable":true,"href":"https:\/\/staging.advisera.com\/27001academy\/wp-json\/wp\/v2\/comments?post=10176"}],"version-history":[{"count":3,"href":"https:\/\/staging.advisera.com\/27001academy\/wp-json\/wp\/v2\/posts\/10176\/revisions"}],"predecessor-version":[{"id":103744,"href":"https:\/\/staging.advisera.com\/27001academy\/wp-json\/wp\/v2\/posts\/10176\/revisions\/103744"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/staging.advisera.com\/27001academy\/wp-json\/wp\/v2\/media\/10177"}],"wp:attachment":[{"href":"https:\/\/staging.advisera.com\/27001academy\/wp-json\/wp\/v2\/media?parent=10176"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/staging.advisera.com\/27001academy\/wp-json\/wp\/v2\/categories?post=10176"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/staging.advisera.com\/27001academy\/wp-json\/wp\/v2\/tags?post=10176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}