Why it matters
The same incident happening twice is a bigger finding to an auditor than the first incident itself.
How a self-led small team implements it
A short "what we'd change" note after any incident or near-miss is enough — formalize it as a habit, not a heavy process.
What auditors expect to see
Post-incident review notes, resulting action items.
Track A.5.27 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS