Control A.5.29Information security during disruption
The organisation must plan how to maintain information security at an appropriate level during disruption.
The insight in this control is that security requirements do not suspend themselves during a crisis, and that the arrangements which restore service frequently weaken them: emergency access granted broadly, changes made without review, alternative sites with different protections, staff working around systems that are unavailable.
Planning means deciding in advance which controls must hold whatever happens, which may be relaxed and on whose authority, and how anything relaxed is restored and reconciled afterwards.
The last part is where this control most often fails. Emergency access granted during an outage and never revoked is one of the most reliably recurring audit findings, and it is the direct product of a continuity plan that thought about restoring the service and not about restoring the controls. A.5.30 covers the readiness of the technology; this covers the security of the arrangements.
How to put this in place
Under crisis pressure, shortcuts are tempting and security is the first thing skipped. Planning which controls must keep running keeps the disruption from becoming a breach.
- Identify which security controls must keep operating during disruption.
- Write into the continuity plans how each will keep running, for example emergency access with logging; if no plan exists yet, start with the business impact analysis in A.5.30.
- Define who may approve emergency exceptions.
- Test the provisions when continuity plans are exercised.
- Review and close emergency accounts after use; see also A.5.30.
Evidence an auditor usually looks for: continuity plans with security provisions, and exercise records covering them.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.