---
title: "ISO/IEC 27035 — Incident Management — KYE Protocol™ coverage"
description: "ISO/IEC 27035 — Incident Management coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it."
url: https://kyeprotocol.com/compliance/iso-27035/
lang: en
source: "KYE Protocol"
---

> ISO/IEC 27035 — Incident Management coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it.

ISO/IEC 27035 — Incident Management

# ISO/IEC 27035 — Incident Management — 100% of in-scope requirements covered.

4 requirements · 3 in scope (3 enforced) · 1 out-of-scope (outside KYE™’s authority layer). The 100% is weighted over the in-scope base.

**Source:** ISO/IEC 27035 specifies a structured approach to information-security incident management — planning, detection and reporting, assessment and decision, responses, and lessons learned — including the careful handling and preservation of incident evidence. KYE Protocol™ governs whether an AI-assisted incident decision under ISO/IEC 27035 may PROCEED to a consequential action — under a named accountable officer's authority, with incident-evidence chain-of-custody recorded, the assessment pinned to verifiable signal sources, and a contestability record for the lessons-learned reconstruction. KYE™ does not detect the incident, run the response tooling, or perform forensics. · **License:** ISO/IEC 27035 is an ISO/IEC international standard; KYE™ registry paraphrases each clause's intent and cites the standard identifier for mapping purposes only. The standard text itself is copyright ISO/IEC and is not reproduced.

## By category

| Category | Reqs | Enforced | Designed | Advisory | Deferred | Coverage |
| --- | --- | --- | --- | --- | --- | --- |
| Incident-evidence chain-of-custody (evidence handling) | 1 | 1 | 0 | 0 | 0 | **100%** |
| Named-authority on the assessment-and-decision response | 1 | 1 | 0 | 0 | 0 | **100%** |
| Contestability & lessons-learned reconstruction | 1 | 1 | 0 | 0 | 0 | **100%** |
| Detection, response tooling & forensic analysis | 1 | 0 | 0 | 0 | 0 | **0%** |

## Every requirement → the KYE™ artefact that enforces it

| ID | Title | Status | KYE™ enforcement |
| --- | --- | --- | --- |
| `iso-27035.evidence-chain-of-custody` | Incident evidence proceeds only with a recorded chain-of-custody (evidence handling) | enforced | **audit\_events**: `kye.evidence.decision_map.v1`, `kye.evidence.pack.v1` **engines**: `internal` **rule\_packs**: `kye:rule-pack:cyber-resilience-incident` **dictionaries**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `iso-27035.assessment-decision-authority` | The assessment-and-decision response proceeds only under a recorded named-authority decision, with the assessment source-pinned | enforced | **audit\_events**: `kye.purpose.request.v1`, `kye.purpose.admissibility.v1`, `kye.evidence.tool_call.v1` **engines**: `internal`, `internal` **rule\_packs**: `kye:rule-pack:cyber-resilience-incident` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `iso-27035.lessons-learned-reconstruction` | Contestability & lessons-learned reconstruction of the incident decision | enforced | **audit\_events**: `kye.evidence.pack.v1`, `kye.replay.context_seal.v1`, `kye.replay.proof.v1` **engines**: `internal`, `internal` **rule\_packs**: `kye:rule-pack:cyber-resilience-incident` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/21-DELEGATED-AUDITABILITY.md` |
| `iso-27035.detection-response-forensics` | Detection, response tooling, and forensic analysis | out-of-scope | _(no enforcement cited)_ |

Canonical KYE™ surfaces referenced on this page: [KYE Protocol™](https://kyeprotocol.com/).