Author : Dr.Mamatha Srirama
ISO/IEC 27035 in Practice: “From ‘That’s Strange…’ to Security Incident
When people hear the term cybersecurity incident management, they often imagine teams of specialists sitting in a Security Operations Center (SOC), monitoring dashboards and responding to cyber threats. While those teams certainly play an important role, the first signs of a cyber incident are often noticed much earlier in substations, control rooms, and field locations.
Operators, technicians, engineers, and maintenance personnel are often the first to encounter something unusual. An alarm, an unexpected login attempt, abnormal network activity, or a suspicious email may seem trivial at first, but these can be the earliest indicators of a cybersecurity incident.
This is where ISO/IEC 27035 provides real value. The standard offers a practical approach to identifying, assessing, escalating, and responding to cybersecurity incidents. More importantly, it helps organizations ensure that the right people are involved at the right time.
Recognizing What Needs to Be Reported
Most cyber incidents do not begin with obvious signs of compromise. They often start as routine operational observations, such as an unexpected alarm, unusual network traffic, a device behaving differently than normal, or a suspicious email received by an employee.
For personnel working in substations and operational facilities, the message is simple: if something appears unusual, report it. Incident reporting forms capture the necessary information for investigation and evidence tracking.
What may initially look like a technical fault could later prove to be a cybersecurity issue. Early reporting allows specialists to investigate quickly and act before the situation develops into a more serious problem. In cybersecurity, early detection can make the difference between a minor event and a major incident.
Understanding the Difference Between a Fault, Event, and Incident
One of the biggest challenges for frontline personnel is determining whether an issue is simply a technical problem or something more serious.
When an issue is detected, personnel should report the observed facts and allow the appropriate team to assess whether malicious activity is involved. A useful working distinction is:
- Fault: A technical problem without an identified indication of malicious activity.
- Security event: An observed activity or occurrence that may have security implications and requires assessment.
- Security incident: A confirmed or sufficiently substantiated security-related occurrence that requires incident response according to organizational procedures.
Knowing When to Escalate
Substation operators and field engineers are responsible for recognizing suspicious activity and ensuring that it is reported through established channels.
Examples of observations that may require escalation include:
- Phishing emails or suspicious attachments.
- Malware detections or unexpected security alerts.
- Unusual or repeated login attempts.
- Unexpected network scanning activity.
- Unusual communications between operational technology (OT) devices.
- Unauthorized configuration changes.
- Unexpected system behaviour or unexplained operational anomalies.
When in doubt, it is better to report an issue than to ignore it. A timely report gives cybersecurity teams valuable time to investigate and contain a potential threat before it affects operations.
Understanding How an Incident Evolves
Cyber incidents rarely appear suddenly. In many cases, they develop through a series of stages.
- An attacker attempts to gain initial access to a system.
- The activity generates an event or security alert.
- The event is reported, assessed, and investigated.
- If a security incident is identified, the incident response process is activated.
- The attack may progress to the manipulation of OT systems, resulting in operational impact.
- If the consequences become severe enough, the situation may escalate into a crisis requiring executive involvement.
Understanding this progression helps personnel appreciate why seemingly minor observations should never be ignored.
Understanding the Roles of the IRT and IMT
ISO/IEC 27035 supports a structured approach to incident management by helping organizations define responsibilities and coordination arrangements.
Incident Response Team (IRT)
The IRT is the technical team responsible for investigating incidents, containing threats, removing malicious activity, and supporting the restoration of affected systems. Its primary focus is the technical response.
Incident Management Team (IMT)
The IMT oversees the broader coordination of the incident. This includes communication, decision-making, escalation, and resource management.
Incident Coordinator and Point of Contact
The Incident Coordinator evaluates reported security events, coordinates assessments, and facilitates the activation of the IRT according to established procedures. Effective communication between technical and management teams is essential for a successful response.
Knowing When to Contact the Point of Contact
Employees often know that something seems wrong but are unsure whom to inform. Organizations should therefore designate a Point of Contact (PoC) for incident-related activities.
Personnel should contact the designated PoC whenever they observe suspicious emails, unexplained system behaviour, security alerts, policy violations, or unexpected operational anomalies.
Prompt communication enables rapid assessment and ensures that potential issues are directed to the appropriate teams without delay. The PoC should follow the organization’s defined reporting and escalation procedures.
Recognizing When an Incident Becomes a Crisis
Not every cybersecurity incident becomes a crisis. However, some incidents extend beyond technology and begin affecting the wider organization.
When an incident causes significant business disruption, impacts power system operations, triggers regulatory reporting requirements, creates legal concerns, attracts media attention, or damages reputation, the situation may require activation of a Crisis Management Team (CMT).
At this stage, the issue is no longer solely a technical problem. It becomes an organizational challenge requiring leadership, business continuity planning, stakeholder communication, and strategic decision-making.
Working with External Stakeholders
Cyber incidents often extend beyond organizational boundaries. Suppliers, service providers, business partners, and customers may all be affected by the same cyber event.
Supply chain compromises, third-party breaches, and sector-wide cyber campaigns demonstrate the importance of collaboration and information sharing. Timely communication with relevant external stakeholders can help prevent further spread of an incident and improve the effectiveness of the overall response.
In critical infrastructure sectors such as power systems, collaboration across organizations is often essential for maintaining resilience.
Conclusion
ISO/IEC 27035 is often viewed as a framework designed for cybersecurity professionals, but its practical value extends far beyond the cybersecurity team. It provides guidance for everyone, from substation operators and field engineers to managers and executives.
Its strength lies in helping people understand what to look for, when to report it, whom to contact, and how different teams work together during an incident. By establishing clear escalation paths and responsibilities, organizations can respond more quickly and effectively when cyber threats arise.