The ultimate how to implement guide to ISO 27001 Annex A 5.29 Information Security During Disruption.
Table of contents
- 1. Define the Minimum Security Baseline for Disruption
- 2. Verify Patch Parity for Standby Systems
- 3. Replicate Firewall and ACL Configurations
- 4. Establish Secure Emergency Communication Channels
- 5. Define “Break Glass” Access Procedures
- 6. Configure Local Logging for Disconnected States
- 7. Test Security Controls During BC Exercises
- 8. Secure the Hardcopy Fallback Process
- 9. Scan Data Integrity Before Repatriation
- 10. Conduct Post-Disruption Security Review
- About the author
1. Define the Minimum Security Baseline for Disruption
Control Requirement: The organisation must determine the level of information security required during a disruption.
Required Implementation Step: Open your Business Continuity Plan (BCP) and insert a specific “Security Baseline” section. You must explicitly list which security controls (e.g., MFA, VPN, Endpoint Protection) are non-negotiable and must remain active even when running on backup infrastructure.
Minimum Requirement: A defined list of “Critical Security Controls” within the BCP documentation.
2. Verify Patch Parity for Standby Systems
Control Requirement: Information security must be maintained at an equivalent level on alternative processing sites.
Required Implementation Step: Log in to your warm or cold standby servers and manually verify the OS and application patch levels. You must ensure that dormant Disaster Recovery (DR) hardware has not drifted behind the production environment, leaving it vulnerable to exploits the moment it is activated.
Minimum Requirement: A patch comparison report showing identical versions between Production and DR servers.
3. Replicate Firewall and ACL Configurations
Control Requirement: Network security perimeters must be maintained during a failover.
Required Implementation Step: Export the configuration files from your primary firewalls and compare them against the secondary site’s network gear using a “diff” tool. You must ensure that Access Control Lists (ACLs) and VLAN tagging rules are identical so that failover does not result in an “allow all” default state.
Minimum Requirement: Evidence of a configuration audit matching rulesets across primary and secondary locations.
DO IT YOURSELF
ISO 27001
All the templates, tools, support and knowledge you need to do it yourself.
4. Establish Secure Emergency Communication Channels
Control Requirement: Communication during a disruption must remain secure.
Required Implementation Step: Provision an out-of-band communication method (e.g., Signal, Wire, or satellite phones) for the Crisis Management Team. Do not rely on corporate email; you must have a pre-tested, encrypted channel that operates independently of your primary infrastructure.
Minimum Requirement: A documented and tested “Secondary Comms” procedure with verifying call logs.
5. Define “Break Glass” Access Procedures
Control Requirement: Access control must be managed securely even when standard authentication servers are unavailable.
Required Implementation Step: Create a physical or digital vault containing emergency local administrator passwords. You must document a strict procedure for accessing these credentials that includes dual-control (requires two people) to prevent abuse during the chaos of an outage.
Minimum Requirement: A sealed “Break Glass” envelope or vault log showing who accessed emergency credentials and why.
6. Configure Local Logging for Disconnected States
Control Requirement: Security monitoring must continue even if the central SIEM is unreachable.
Required Implementation Step: Configure your critical servers to cache logs locally or forward them to a local collector at the DR site. You must ensure that if the link to the primary Security Operations Centre (SOC) is severed, forensic evidence is still being generated and stored.
Minimum Requirement: A test log file generated and stored locally on a DR asset during a network isolation test.
7. Test Security Controls During BC Exercises
Control Requirement: The effectiveness of security controls during disruption must be verified.
Required Implementation Step: During your annual Business Continuity test, assign a security analyst to run a vulnerability scan or penetration test against the active DR environment. You must prove that the failover environment is not just functional, but also hardened.
Minimum Requirement: A vulnerability scan report generated specifically from the DR environment during a live exercise.
8. Secure the Hardcopy Fallback Process
Control Requirement: Information security must extend to manual or paper-based workarounds.
Required Implementation Step: If your BCP calls for using pen and paper, distribute cross-cut shredders and lockable storage bins to the temporary workspace. You must ensure that sensitive physical records generated during the outage are not left unsecured on desks.
Minimum Requirement: Physical inspection logs of the temporary command centre confirming secure disposal facilities are present.
9. Scan Data Integrity Before Repatriation
Control Requirement: The return to normal operations must not introduce compromised data.
Required Implementation Step: Before failing back to the primary site, scan all data created or modified during the disruption for malware. You must ensure that you are not syncing infected files from the less-secure emergency environment back into the clean production network.
Minimum Requirement: A malware scan report covering all “delta data” generated during the disruption period.
10. Conduct Post-Disruption Security Review
Control Requirement: Lessons learned regarding security performance must be captured.
Required Implementation Step: Convene a specific security debrief following any test or actual incident. Review the audit trails to determine if any emergency privileges were excessive or if any security controls failed to start, and update the BCP accordingly.
Minimum Requirement: Minutes from the post-test review explicitly discussing “Security Control Performance”.
About the author
