Control A.5.5Contact with authorities
The organisation must establish and maintain contact with relevant authorities.
“Relevant” is decided by context: the data protection authority, the national CSIRT or cybersecurity competent authority, law enforcement, sector supervisors, and in the EU the bodies designated under national NIS2 transposition or, for financial entities, the competent authority under DORA.
The purpose is that the contact exists before it is needed. An organisation that first identifies who to call while an incident is running loses hours it does not have, and a statutory reporting deadline measured in 24 or 72 hours does not pause for it.
What the control asks for is specific and small: knowing which authorities are relevant, holding current contact details, knowing what each expects and when, and having decided who in the organisation is authorised to make the contact. That last element is the one most often missing, and it is the reason a first report is sometimes delayed by an internal question about who may send it.
How to put this in place
When an incident or a legal duty arises, you need to know who to call and who may call them. Looking for the number during a breach wastes the time that notification deadlines allow.
- Decide which authorities could matter to you, such as regulators, a data protection authority, a national cyber-security body and the police.
- Record the contact route for each, and who in your organisation may make contact.
- Write the contact steps and any notification deadlines into the incident procedure; see also A.5.24 and A.5.26.
- Make sure someone authorised can act out of hours.
- Check the list at least every 12 months and after any change of contact.
Evidence an auditor usually looks for: the contact list with its review date, the incident procedure referring to it, and records of any notifications made.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.