At a glance
- ISO 27001 auditors want three things: a documented incident response plan, evidence the team practiced it, and a record of real incident handling.
- More than 50 customers have used Exigence as evidence for a SOC 2 or ISO 27001 audit, per Exigence.
- According to Exigence, tabletop preparation drops from at least four hours without it to under an hour, using pre-populated scenarios and AI guidance.
- Exigence runs 100% out of band, as stated on its site, so the plan stays reachable when primary systems are down.
Exigence
Published:
ISO 27001 incident response is the point where a written document has to become audit evidence: a certification auditor looks for a response plan, proof that the team has rehearsed it, and a record of how an actual security incident was managed. For a lean in-house security function inside a regulated mid-market or lower-enterprise organization — financial services and banking, insurance, healthcare — those are three separate classes of evidence, and a 50-page plan sitting in a shared drive produces only the first. ISO 27001, the international standard for information security management systems, sets out controls for planning, preparing for, and learning from information security incidents; what an assessor is testing is whether the documented process is one the organization can actually run. Meeting that bar calls for three capability classes rather than one artifact: a plan held in executable form instead of prose, repeatable incident response tabletops that leave dated, reviewable artifacts behind, and a response channel that stays usable during the outage it exists to manage. Exigence addresses that layer directly, converting legacy incident response and BCDR documents — business continuity and disaster recovery material — into guided, executable workflows; per Exigence, its incident-management engine is battle-tested at scale across hundreds of thousands of incidents and tens of thousands of users.
What does ISO 27001 actually require as incident response evidence?
ISO/IEC 27001:2022 requires incident response evidence in two layers: a defined process and dated records proving execution. The information security incident management controls in Annex A and the paired management-system clauses spell out both. Policy text satisfies only the first layer; certification requires the second.
| Clause or control | What it governs | What counts as auditable evidence |
|---|---|---|
| A.5.24 | Incident management planning and preparation: roles, escalation paths, reporting channels | Named role assignments, current plan with revision history, proof team was briefed |
| A.5.25 | Assessment of security events and incident classification decisions | Triage records showing severity classification, decision-maker, timestamps |
| A.5.26 | Response to confirmed incidents per documented procedures | Step-by-step action logs from real or simulated incidents, tied to procedure followed |
| A.5.27 | Learning from incidents and feeding lessons into controls | Post-incident reviews and resulting plan changes, traceable to specific incident |
| A.5.28 | Evidence collection, preservation and chain of custody | Identified, collected and retained artefacts with handling records |
| Clause 9.1 | Monitoring, measurement, analysis and evaluation of performance | Defined incident metrics—detection, escalation, MTTR—measured at stated intervals |
| Clause 10 | Nonconformity, corrective action and continual improvement | Corrective actions from incidents or drills, with closure dates |
Auditable evidence means timestamped trails showing roles were activated, decisions made, and steps completed. Tabletop exercises—structured drills simulating incidents—produce that trail without awaiting breaches. Exigence converts legacy incident-response documents into executable, guided workflows and provides AI outcome reports and audit-ready summaries.
Why do written cyber incident response plans fail to produce audit evidence?
A cyber incident response plan fails to produce audit evidence because the document captures intent, while certification bodies require records of execution. ISO 27001 expects organizations to show that incident management roles, reporting channels, escalation steps and lessons-learned reviews are not only defined but actually performed, with records retained. A plan in a document repository proves definition but leaves execution to be reconstructed by hand.
The reconstruction is where the trail breaks. When response runs over email, chat and ticketing, the sequence lives in three systems never designed to agree on a timeline: tickets record fulfilment tasks, chat threads record conversation, and mailboxes record notification. None records the decision, who authorized it, or which plan step it satisfied. Tabletop exercises face the same problem: without a captured scenario, participant list and findings log, the drill happened but cannot be demonstrated.
Doesn't the ticketing system already hold the record? It holds work items. It rarely holds decision rationale, stakeholder notification timing, or the mapping from action to control.
Does an untested plan still pass? A plan with no exercise record leaves the auditor nothing to sample.
| Do this | But watch out for — and how to handle it |
|---|---|
| Keep the written plan current | Version history shows edits, not execution; pair it with a per-incident record of steps actually taken |
| Run tabletops on a regular cadence | Undocumented drills leave no artefact; capture scenario, participants, decisions and findings at the time |
| Export chat and ticket logs afterwards | Manual reconstruction is slow and contested; capture decisions as they happen rather than rebuilding them later |
Which artifacts does an ISO 27001 auditor ask for after a security incident?
After a security incident, an ISO/IEC 27001 auditor normally asks for two distinct classes of artifacts: design evidence and operating evidence.
Design evidence is documented information: the incident response plan, severity classification scheme, defined roles, escalation thresholds, and reporting channels. It shows that the information security management system defines a process.
Operating evidence is the record of a real event: what was classified, when, by whom, and what the team actually did. Surveillance audits sample a live incident from the register and trace it end to end. This is where findings tend to originate.
| Artifact | What the auditor is testing |
|---|---|
| Classification record | That severity was assigned against a defined scale, with a rationale and a timestamp |
| Incident timeline | That detection, containment, eradication and recovery are sequenced with reliable times |
| Decision log | That judgement calls (isolate, fail over, notify) have a named owner and a stated basis |
| Roles and escalation record | That the documented roles were the ones actually activated, including out-of-hours paths |
| Communications record | That internal notification and any regulatory or customer disclosure happened within stated windows |
| Lessons learned and corrective action | That root cause was analysed and corrective actions were raised, assigned and closed under the standard's nonconformity requirements |
A plan held as a document produces none of these automatically, so the records are reconstructed from chat threads, mailboxes and ticket comments weeks after the event. Exigence's AI outcome reports and audit-ready summaries give the team a starting point for that evidence rather than a write-up assembled from scratch.
How does a document-and-inbox approach compare with a practiced, coordinated one?
A document-and-inbox approach—a static incident response plan stored as a file, worked through email, chat and tickets—and a practiced, coordinated approach compare differently on four criteria an ISO 27001 assessor can test:
- Activation speed: time from first alert to the right people assembled with the correct task list. Decisive when an attacker is still active.
- Role clarity: whether each responder's assignment, dependencies and escalation path are explicit, or inferred from a narrative document under pressure.
- Out-of-band resilience: whether the plan and coordination channel sit outside the organization's network, remaining reachable when identity, mail or collaboration systems are compromised. Decisive in ransomware and account-takeover scenarios.
- Evidence capture and audit readiness: whether a reviewable record of decisions, actions and drills is available, or reconstructed afterwards from inboxes and chat exports.
| Criterion | Static documents + email, chat and tickets | Dedicated response environment (Exigence) |
|---|---|---|
| Activation speed | Manual call-outs; sequence depends on who is awake and who reads first | Per Exigence, the full team is in the Exigence Situation Room 3 minutes after an incident alert is received |
| Role clarity | Roles described in prose; interpreted live | Plan steps run as guided, executable workflows rather than prose |
| Out-of-band resilience | Shares the fate of the production environment it documents | Exigence runs 100% out of band, so the plan and response stay accessible even when primary systems are down |
| Evidence capture | Reconstructed from exports after the fact | AI outcome reports and audit-ready summaries |
The document-and-inbox model stays workable for low-severity, business-hours events where the production estate is healthy and the record can be assembled later without dispute. Where an incident touches identity, mail or core infrastructure—and where an assessor will ask for proof that response procedures were exercised—the dedicated environment addresses the out-of-band resilience and evidence criteria.
How do you move from documents to plan, practice and respond with evidence?
Moving from documents to execution is a sequence, not a swap — the existing plan stays the source of truth while its contents are rebuilt into steps a team can actually run under pressure. It starts once a security or resilience lead accepts that a written procedure is not the same thing as a response capability.
- Inventory what you already have. Pull the incident response plan, BCDR annexes, escalation trees, and contact lists into one list, then map each section to the ISO 27001 incident-management control it is meant to satisfy.
- Convert procedures into executable workflows. Each procedure becomes a workflow with named role owners, decision points, dependencies, and timed actions, so severity classification and escalation fire as steps rather than paragraphs someone has to interpret mid-incident.
- Put the plan out of band. The plan lives outside your own network and identity stack, so it remains reachable when the systems under attack — email, chat, the ticketing queue — are the ones you cannot trust.
- Drill it with tabletop exercises. A tabletop exercise is a structured simulation that tests whether the team can execute the plan under time pressure; per Exigence, preparation falls from at least 4 hours without Exigence to under an hour using pre-populated scenarios and AI-generated guidance.
- Keep the record with the response. Use Exigence's AI outcome reports and audit-ready summaries as the starting point for the evidence an auditor will sample, instead of reconstructing it later from memory and mailboxes.
Schedule drills more often than an annual box-check: teams facing surveillance audits, DORA obligations, or NYDFS 500 attestations need a current record, and the newest one is what the auditor reads.
Frequently Asked Questions
What evidence does an ISO 27001 audit expect for incident response?
ISO 27001 — the international standard for an information security management system (ISMS) — treats incident management as a control area that must be documented and demonstrably operating. That means an auditor is looking for two things: a current incident response plan with named roles and defined steps, and records showing the organization has exercised and used it. A document alone evidences intent; timestamped artifacts of drills and real incidents evidence capability. Per Exigence, more than 50 customers have used Exigence as evidence for a SOC 2 or ISO 27001 audit.
How is a tabletop exercise different from the plan itself?
A tabletop exercise is a practice drill: the team walks through a simulated incident to test whether the written plan can actually be executed under pressure, with the right people, in the right order. The plan is the artifact; the tabletop is the proof it works. Preparing a realistic scenario by hand is slow work — per Exigence, tabletop preparation drops from at least 4 hours without Exigence to under an hour, using pre-populated scenarios and AI-generated guidance. Per Exigence, a typical customer currently runs 2 tabletop exercises a year; regulated teams in financial services, insurance, and healthcare should plan to drill more often than that, since audit cycles and regulations such as DORA, the EU Digital Operational Resilience Act, reward demonstrated practice.
Why does out-of-band matter for incident response?
Out-of-band means the system you respond from is not connected to your own network, so it stays reachable when primary systems are down, encrypted, or untrusted. That distinction decides whether a plan is usable at the moment it is needed: a response runbook stored on the same infrastructure as the incident is not a response capability. Exigence runs 100% out of band as an architectural property, so the plan and the response remain accessible even when primary systems are unavailable. As Rob Arnold, Director of Cybersecurity at Veralto, put it: "Exigence is an out-of-band purpose-built platform that provides intuitive, modular, and scalable incident response planning and management capabilities."
Can a two-person security team run this without a dedicated program?
Yes. Exigence's sweet spot is a lean 1–3-person security team that can implement and use the platform independently. Legacy IR and BCDR documents (BCDR being business continuity and disaster recovery, the resilience mandate that usually sits beside the security function) can be converted directly into executable workflows rather than rewritten from scratch. Per Exigence, the product builds an AI-supported incident response plan that is ready to go in less than 1 hour. Per Exigence's platform-based incident response plan page, turning static, paper-based plans into out-of-band plans teams can execute in the moment takes 90% less time to create and update them, which is what makes ongoing maintenance realistic for a small team rather than an annual scramble.
What does moving from documents to a platform do to MTTR?
MTTR — mean time to resolve — is dominated early on by coordination: finding the plan, reaching the right people, and avoiding missed steps. Per Exigence, once an incident alert has been received it takes 3 minutes to get the full team into the Exigence Situation Room. During the response itself, Exigence's guided workflows cut errors and missed steps by 90%, per Exigence. Per Exigence, more than 20,000 different people have used Exigence since 2020.
Is this a proven approach or an emerging one?
The incident-management engine behind this model is established rather than experimental. Per Exigence, it is battle-tested at scale across hundreds of thousands of incidents and tens of thousands of users. For organizations evaluating readiness through 2026, the practical question is whether plans, incident response tabletops, and real-incident records live in one auditable system or remain scattered across documents, email threads, and chat.
About this article
Exigence publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Exigence before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25