Control A.5.30ICT readiness for business continuity
ICT readiness must be planned, implemented, maintained and tested based on business continuity objectives and ICT continuity requirements.
New in the 2022 edition, and it draws an important line: business continuity sets the objectives — what must keep running, how quickly it must return, how much data may be lost — and ICT readiness is the capability to meet them.
The control asks for that capability to be planned against the stated objectives, implemented, maintained and tested. Without the business objectives it is arbitrary; without testing it is a claim.
The common failure is a recovery objective asserted rather than demonstrated. An organisation states a four-hour recovery time, holds backups under A.8.13 and redundancy under A.8.14, and has never restored the service end to end to see how long it takes. The test is the control. And as A.5.29 notes, restoring the service is not the same as restoring the security of the service.
How to put this in place
The business can only survive an outage for so long, and backups that have never been restored prove little. This control ties recovery to what the business needs.
- Run a business impact analysis to find critical services.
- Set recovery time and recovery point objectives for each.
- Design backups and redundancy to meet them.
- Test recovery of critical systems at planned intervals, for example every 12 months.
- Record times achieved against targets and fix the shortfalls.
Evidence an auditor usually looks for: the business impact analysis with objectives, and recovery test reports showing times achieved against targets.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists ICT continuity plans and records of their tests among the documents auditors commonly expect for this control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.