Control A.5.30ICT readiness for business continuity
What it means in practice
ICT readiness must be planned, implemented, maintained and tested based on business continuity objectives and ICT continuity requirements.
New in the 2022 edition, and it draws an important line: business continuity sets the objectives — what must keep running, how quickly it must return, how much data may be lost — and ICT readiness is the capability to meet them.
The control asks for that capability to be planned against the stated objectives, implemented, maintained and tested. Without the business objectives it is arbitrary; without testing it is a claim.
The common failure is a recovery objective asserted rather than demonstrated. An organisation states a four-hour recovery time, holds backups under A.8.13 and redundancy under A.8.14, and has never restored the service end to end to see how long it takes. The test is the control. And as A.5.29 notes, restoring the service is not the same as restoring the security of the service.
How to put this in place
The business can only survive an outage for so long, and backups that have never been restored prove little. This control ties recovery to what the business needs.
- Run a business impact analysis to find critical services.
- Set recovery time and recovery point objectives for each.
- Design backups and redundancy to meet them.
- Test recovery of critical systems at planned intervals, for example every 12 months.
- Record times achieved against targets and fix the shortfalls.
Evidence an auditor usually looks for: the business impact analysis with objectives, and recovery test reports showing times achieved against targets.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Mandatory ISMS Documentation Checklist
in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists ICT continuity plans and records of their tests among the documents auditors commonly expect for this control. - Word
Stage 1 and Stage 2 Audit Preparation Guide
in ISO 27001 Implementation & Certification ReadinessListed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge. - PowerPoint
Tabletop Scenario — Critical Supplier Outage
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Whole deck. - Excel
Digital Operational Resilience Testing Programme
in DORA ICT Risk & Resilience ReadinessIts Framework References list this control. Supported by: Programme sheet, DT-14: the tests of the continuity, response and recovery plans, and the dates they fall due. - Word
Business Continuity & ICT Resilience Policy
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: Objectives, dependencies, plans, recovery methods and recovery tests for each critical service (RR-03 to RR-16, RR-21 to RR-26). - Word
Cyber Recovery Operating Procedure
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: The whole procedure: recovering ICT to meet each service's objectives after a disruption. - Excel
Critical Service Recovery Objectives Matrix (RTO, RPO, MTD)
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: The whole workbook: the recovery objectives of each critical service, and whether its ICT can recover within them. - Word
Cyber Recovery Plan Template
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: The whole template. - Excel
Clean-Room Recovery & Rebuild Checklist
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: The checklist as a whole: systems returned to service after a disruption only when they can be trusted. - Excel
Resilience Dependency Register
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: Services sheet: each critical service's dependencies checked against its recovery objectives, and its recovery time after an attack. - Excel
Business Impact Analysis Questionnaire
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: The whole workbook: the business impact analysis from which the objectives matrix sets each critical service's recovery objectives, which its ICT must be ready to meet. - Word
IT Disaster Recovery Procedure
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: The whole procedure: recovering the ICT a critical service needs within its objectives. - Word
Continuity & Disaster Recovery Test Plan and Report
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: The whole template: each service's recovery tested against its objectives. - Excel
ISO 22301 Alignment Map
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: Alignment Map, clauses 8.2 to 8.5: the impact analysis, recovery objectives, plans and tests the pack's ICT readiness rests on, placed against the standard's headings.