# ISO/IEC 27701 A.3.11 — Incident management planning

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_iso27701_a311_26f396dbb1-isoiec-27701-a311-incident-management-planning
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [ISO/IEC 27701 (Privacy Information Management)](https://support.icompaas.com/support/solutions/c_gen_iso27701) › [Security considerations](https://support.icompaas.com/support/solutions/folders/f_gen_cgeniso27701_securityconsiderations)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

ISO/IEC 27701 · Control A.3.11 · Priority: critical · Component: Security considerations

### What this control covers

Plan and prepare for incidents related to PII processing with defined processes, roles and responsibilities. Implementation: Define incident procedures, roles and notification requirements. Justification: Enables timely and effective breach response.

### Why it matters

How quickly and methodically you contain an incident determines the regulatory consequence — most fines are not for the breach itself but for the slow or absent response.

### How to implement

#### AWS

Wire **GuardDuty**, **Security Hub** and **Macie** findings into your ticketing/SIEM via EventBridge. Maintain documented playbooks for IAM-key compromise, EC2 instance compromise, S3 data exposure, and run **quarterly tabletop exercises**.

#### Azure

Use **Defender for Cloud** + **Microsoft Sentinel** with playbooks (Logic Apps) for automated containment — disable user, isolate VM (NSG), revoke session tokens. Keep an on-call rotation in Teams with PagerDuty.

#### GCP

Use **Cloud KMS** with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. **Sensitive Data Protection** (DLP API) inspects/de-identifies PII at scale.

#### Google Workspace

Enable **client-side encryption** for Drive/Docs and turn on **Drive Labels + DLP** rules to prevent external sharing of regulated data classes.

#### GitHub

Subscribe to **secret-scanning** alerts and **Dependabot** security advisories; require triage SLAs by severity. For exposed secrets, rotate at the cloud provider FIRST then revoke at GitHub — order matters.

### Evidence to collect

-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.
-   `ticketing_workflow` — See the iCompaas Evidence library for the canonical source for this evidence type.
-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policies, procedures, and registers document the safeguard. Infrastructure posture tooling (AWS/Azure/GCP configuration, encryption, backup, logging) verifies technical enforcement. Service management or request-handling tickets prove timely handling. Focus: Incident management planning.

### Quick checklist

-   Implement — Incident Management Planning
-   Define — Incident Management Planning
-   Process — Incident Management Planning

### Related articles on this site

-   [Roles and responsibilities](https://support.icompaas.com/support/solutions/articles/62000225140-roles-and-responsibilities)
-   [NIST 800-171 3.2.1 Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to](https://support.icompaas.com/support/solutions/articles/62000229264-nist-800-171-3-2-1-ensure-that-managers-systems-administrators-and-users-of-organizational-systems-)
-   [NIST 800-171 3.2.2 Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.](https://support.icompaas.com/support/solutions/articles/62000229266-nist-800-171-3-2-2-ensure-that-personnel-are-trained-to-carry-out-their-assigned-information-security)
-   [NIST 800-171 3.3.4 Alert in the event of an audit logging process failure.](https://support.icompaas.com/support/solutions/articles/62000229274-nist-800-171-3-3-4-alert-in-the-event-of-an-audit-logging-process-failure-)