Control A.5.29Information security during disruption
What it means in practice
The organisation must plan how to maintain information security at an appropriate level during disruption.
The insight in this control is that security requirements do not suspend themselves during a crisis, and that the arrangements which restore service frequently weaken them: emergency access granted broadly, changes made without review, alternative sites with different protections, staff working around systems that are unavailable.
Planning means deciding in advance which controls must hold whatever happens, which may be relaxed and on whose authority, and how anything relaxed is restored and reconciled afterwards.
The last part is where this control most often fails. Emergency access granted during an outage and never revoked is one of the most reliably recurring audit findings, and it is the direct product of a continuity plan that thought about restoring the service and not about restoring the controls. A.5.30 covers the readiness of the technology; this covers the security of the arrangements.
How to put this in place
Under crisis pressure, shortcuts are tempting and security is the first thing skipped. Planning which controls must keep running keeps the disruption from becoming a breach.
- Identify which security controls must keep operating during disruption.
- Write into the continuity plans how each will keep running, for example emergency access with logging; if no plan exists yet, start with the business impact analysis in A.5.30.
- Define who may approve emergency exceptions.
- Test the provisions when continuity plans are exercised.
- Review and close emergency accounts after use; see also A.5.30.
Evidence an auditor usually looks for: continuity plans with security provisions, and exercise records covering them.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Word
Incident Response Plan
in Security Incident ManagementIts Framework References list this control. Supported by: The crisis team; recovery; the hand-over to the business continuity plan. - Word
Ransomware Response Playbook
in Security Incident ManagementIts Framework References list this control. Supported by: Role actions by phase; Recovery criteria. - Excel
Incident Response Readiness Checklist
in Security Incident ManagementIts Framework References list this control. Supported by: Backups and recovery, and the crisis team: security maintained during disruption. - PowerPoint
Tabletop Scenario — Ransomware Encryption of Core Systems
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Whole deck. - Word
Business Continuity & ICT Resilience Policy
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: The whole policy: keeping services going through a disruption, including a cyberattack. - Word
Cyber Recovery Plan Template
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: PS-2, PS-3; the cyber route throughout. - Excel
Crisis & Recovery Responsibility Matrix
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: The workbook as a whole: who decides and acts to keep information secure during a disruption, with deputies. - Word
Site & Business Unit Continuity Plan Template
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: CP-4: losing systems after a cyberattack, with P09 running the incident; CP-6: records on paper protected. - Word
Outage Communications Template Set
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: When this set does not apply: a suspected attack moves the messages to P09. - Excel
ISO 22301 Alignment Map
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: Alignment Map and Beyond the Pack: where the pack's plans for running the organisation through a disruption sit among the headings of a continuity management system, and what such a system adds.