ISO/IEC 27035
Information Security Incident Management
Prepare for security incidents before they happen and respond with structure when they do.
What ISO/IEC 27035 covers
ISO/IEC 27035 provides guidance on managing information security incidents, from planning and preparation through detection, response, and learning.
It describes a structured approach: plan and prepare, detect and report, assess and decide, respond, and learn lessons.
The standard helps professionals understand how incident management connects people, processes, and technology across an organization.
What you can build knowledge in
- AreaInformation security incident management principles.
- AreaIncident management policy, planning, and preparation.
- AreaDetecting, reporting, and assessing information security events.
- AreaDeciding when an event becomes an incident.
- AreaIncident response, containment, and recovery coordination.
- AreaLessons learned and continual improvement.
Where it shows up at work
Preparing the response team
Defining roles, contacts, and procedures before an incident occurs.
Triaging events
Assessing whether an event is an incident and how serious it is.
Learning after an incident
Reviewing what happened and improving plans, controls, and training.
Who should explore it, and where it applies
Who Should Explore It?
Security operations professionals, incident responders, IT managers, information security managers, risk and continuity professionals, auditors, and consultants.
Professional Applications
Incident response planning, security operations support, incident handling procedures, readiness exercises, security assurance, and consulting.
Professional Pathways to Explore
- ISO/IEC 27035 Foundation
- Lead Incident Manager
Subject to current scheme availability.
Incidents are inevitable in most organizations. A planned, practiced approach helps teams respond consistently and learn from what happens.
Choose the right professional certification level
Different qualifications develop different kinds of professional knowledge. Choose according to your goals and experience.
Foundation — Establish Your Knowledge
Foundation-level training introduces the purpose, terminology, principles, structure, and fundamental concepts of a particular standard.
Best suited to: Professionals seeking a structured introduction before taking on specialist responsibilities.
Lead Manager and Advanced Professional Pathways
Certain disciplines offer Manager, Lead Manager, or other advanced qualifications. These may address professional responsibilities that are not limited to implementation or auditing.
Best suited to: Individuals developing management, advisory, specialist, or leadership responsibilities in the relevant discipline.
Important: Attending advanced training does not automatically qualify a candidate for the corresponding advanced credential. Every credential is governed by its specific eligibility requirements.
Your professional certification journey
Before investing in training, understand the steps involved and the outcomes you can reasonably expect.
- Step 1
Identify Your Professional Goal
Begin with your current responsibilities, relevant experience, and the knowledge you want to develop.
- Step 2
Select the Relevant Standard
Explore the standard's purpose, scope, practical applications, and relationship to your professional interests.
- Step 3
Choose an Appropriate Training Pathway
Compare Foundation, specialist, Manager, Lead Implementer, Lead Auditor, or other applicable options.
- Step 4
Confirm the Training Arrangements
Review the course title, edition, provider, delivery, fees, examination arrangements, and eligibility.
- Step 5
Complete the Training
Engage with the material, exercises, case studies, discussions, and assessments included in the offering.
- Step 6
Meet Examination Requirements
Where an examination is part of the scheme, satisfy the required assessment criteria.
- Step 7
Apply for the Appropriate Professional Credential
Where a PECB credential is available, submit the application and satisfy the scheme's conditions.
- Step 8
Maintain and Develop Your Expertise
Stay informed about revised standards, emerging risks, and continuing professional development requirements.
Confirm the training arrangements
Before enrolling, review:
- The exact course title and applicable standard edition.
- Training provider and credentialing organization.
- Delivery mode and schedule.
- Curriculum and learning materials.
- Training fees and what they include.
- Examination arrangements.
- Eligibility and experience requirements.
- Cancellation, rescheduling, and examination retake policies.
Arrangements can vary by program and provider.
Organizational Certification
An organization may obtain independent third-party certification to certain ISO management-system standards. The certificate concerns the organizational management system and its defined scope—not the personal qualifications of every employee.
Professional Certification
Individuals may pursue professional training, examinations, and credentials associated with ISO standards through certification bodies such as PECB. Depending on the scheme, these may recognize knowledge, qualifying experience, or other defined competencies.
Training Completion
Completing a training course demonstrates participation or successful course completion under the provider's rules. It does not necessarily establish eligibility for a professional credential.
Professional learning for organizations
INCYB welcomes enquiries from organizations interested in exploring standards-based professional learning for their employees and management teams.
Explore ISO Professional Learning for TeamsPotential Organizational Learning Formats
Depending on the confirmed offering, professional learning arrangements may include individual participation, group training, role-specific learning pathways, awareness sessions, and examination-oriented programs.
Actual delivery modes, schedules, course availability, trainer arrangements, and certification provisions must be confirmed for each engagement.
Your questions answered
Can I pursue ISO-related learning without a cybersecurity or IT background?
Yes.
ISO standards address many disciplines, including enterprise risk, compliance, quality, project management, manufacturing, occupational safety, food safety, environmental management, energy management, and sustainability.
Your existing professional background may be relevant to multiple pathways.
Which ISO qualification should cybersecurity professionals consider?
ISO/IEC 27001 is particularly relevant to information security management, implementation, and auditing.
ISO/IEC 27005 focuses on information security risk management.
ISO/IEC 27701, ISO/IEC 42001, and ISO 22301 may also be relevant to professionals interested in privacy, AI governance, and business continuity.
The best choice depends on the responsibilities you want to develop.
Does ISO directly certify professionals?
No. ISO develops and publishes international standards but does not directly award individual professional certifications.
Professional credentials relating to ISO standards may be issued by separate certification bodies under their applicable schemes.
Is PECB certification the same as organizational ISO certification?
No.
PECB professional certification concerns individuals who meet the requirements of a defined professional certification scheme.
Organizational ISO certification concerns the conformity of an organization's management system to the relevant standard.
Do I need professional experience before enrolling in an ISO training course?
Not necessarily.
Some Foundation courses are designed for individuals with limited prior knowledge, while advanced programs may recommend relevant experience.
Certification eligibility may require more experience than training participation. Always review the requirements for the specific program and credential.
Is passing a professional certification exam enough to become certified?
Not always.
Depending on the credential, successful candidates may also need to submit an application, demonstrate qualifying experience, document relevant projects or audits, and meet other certification scheme requirements.
Passing an examination does not automatically confer every available professional designation.
Are the courses based on the latest ISO editions?
Course edition alignment depends on the training provider, the specific course, and the release or transition status of the applicable certification scheme.
Before enrollment, confirm the exact edition addressed by the training and examination.
Are all 25 learning areas available as scheduled courses through INCYB?
The catalogue represents professional learning areas available for enquiry and exploration.
Individual courses, delivery formats, certification schemes, and schedules are subject to confirmation.
A listed topic should not be interpreted as a commitment that a particular course session or professional credential is currently available through INCYB.
Explore the other pathways
- 01ISO/IEC 27001Information Security Management Systems
- 02ISO/IEC 27002Information Security Controls
- 03ISO/IEC 27005Information Security Risk Management
- 05ISO/IEC 27040Storage Security
- 06ISA/IEC 62443Industrial Automation and Control Systems Security
- 07PECB CISOChief Information Security Officer
- 08EBIOSEBIOS Risk Manager
Important Information About ISO Standards, Professional Training & Certification
The catalogue is informational. The inclusion of a standard or course category does not guarantee the availability of a training session, examination, specific credential, or certification service through INCYB. Course delivery arrangements, fees, schedules, languages, prerequisites, examinations, and certification conditions must be confirmed for each offering.
ISO and IEC develop and publish international standards. They do not themselves issue the individual professional certifications described on this page.
PECB credentials are governed and issued by PECB under its applicable examination and certification rules. Reference to a PECB pathway does not, by itself, establish that INCYB is an authorized PECB partner, approved training provider, or representative.
Individual training, course completion, examination success, professional certification, organizational management-system certification, and laboratory accreditation are distinct processes and outcomes.
Professional learning and certification do not guarantee employment, promotion, salary increases, regulatory compliance, or organizational certification.
Make Your Next Professional Qualification Count.
Contact INCYB with your professional background, area of interest, preferred learning level, and intended qualification.
Explore ISO/IEC 27035 Incident Management Training