Introduction
I am going to show you what ISO 27001 Annex A 5.29 Information Security During Disruption is, what’s new, give you ISO 27001 templates, an ISO 27001 toolkit, show you examples, do a walkthrough and show you how to implement it.
I am Stuart Barker the ISO 27001 Ninja and using over 30 years experience on hundreds of ISO 27001 audits and ISO 27001 certifications I show you exactly what changed in the ISO 27001 update and exactly what you need to do for ISO 27001 certification.
Table of contents
ISO 27001 Information Security During Disruption
ISO 27001 Annex A 5.29 Information Security During Disruption is an ISO 27001 control that wants you to plan and maintain information security at an appropriate level to you during disruption.
Purpose
The purpose of ISO 27001 Clause 5.29 is protect information and other associated assets during disruption.
Definition
The ISO 27001 standard defines ISO 27001 Annex A 5.29 as:
The organisation should plan how to maintain information security at an appropriate level during disruption.
ISO 27001:2022 Annex A 5.29 Information Security During Disruption
Implementation Guide
It is my experience that the best way to implement Annex A 5.29 is to replicate the same level of information security in your business continuity plans, disaster recovery plans and disruption operations. Doing anything else, whilst you may need to and you should, will lead to a more complex environment open to a greater level of questioning come your audits.
Watch the tutorial
ISO 27001 Templates
How to comply
To comply with ISO 27001 Annex A 5.29 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:
- Have an ISO 27001 topic specific policy for business continuity
- Implement a process for business continuity and disaster recovery
- Incorporate that process into your business operations
How to pass an audit
To pass an audit of ISO 27001 Annex A 5.29 you are going to make sure that you have followed the steps above in how to comply and be able to evidence it in operation.
- Have a business continuity plan and disaster recovery plan
- Include in the plans the requirements for information security and what is different to normal operation
- Test the plans
- Test the information security requirements are in place as designed
What the auditor will check
The audit is going to check a number of areas. Lets go through the main ones
1. That you have documented your business continuity and disaster recovery plans
The audit will check the documentation, that you have reviewed it and signed and it off and that it represents what you actually do not what you think they want to hear.
2. That you can demonstrate the process working
They are going to ask you for evidence to the information security during a disruption and take at least one example. For this example you are going to show them and walk them through the process and prove that you followed it and that the process worked.
3. That you can learn your lesson
Documenting your lessons learnt and following this through to continual improvements or incident and corrective actions will be checked.
Top 3 mistakes people make
The most common mistakes people make for ISO 27001 Annex A 5.29 are
1. Not having a documented disaster recovery and business continuity policy and plans.
This is the most common mistake made by organisations. Documentation is essential for effective incident response.
2. Not including information security requirements in the plans
There are so many mistakes that can be made but this particular requirement is about information security in a disruption so be sure you understand it and can talk to it and evidence it.
3. Not Testing
It is important to monitor its effectiveness of the information security during a disruption. This means reviewing the process, conducting internal audits and reviewing actual incidents for lessons learnt. The number one thing to do it test and be able to evidence the test.
By avoiding these mistakes, you can ensure that you have an effective collection of evidence plan in place.
FAQ
This ISO 27001 controls wants you to implement and maintain information security controls as well as supporting systems and tools in your business continuity and IT recover / continuity plans.
It wants process to maintain existing information security controls during disruption and compensating controls for those occasions where security controls cannot be maintained to the same level.
Other than your ISO 27001 certification requiring it, the following are the top 5 benefits of ISO 27001 Annex A 5.29:
1. You cannot get ISO 27001 certification without it.
2. Improved security: You will have effective information security during a disruption
3. Reduced risk: You will reduce the information security risks of a disruption
4. Improved compliance: Standards and regulations require an effective information security during a disruption be in place
5. Reputation Protection: In the event of a breach having an effective information security during a disruption system in place will reduce the potential for fines and reduce the PR impact of an event
ISO 27001 Annex A 5.29 is important because during a disruption or incident the information security requirements can get lost. Short cuts can happen that compromise information security. Controls that are in production or the normal running of business can get turned off exposing the organisation to significant risk. The guidance in ISO 27001 Annex A 5.29 can help you to develop and implement an effective plan of what to do for information security during a disruption with the greatest chance of success.
All of the business continuity documents that you need are included in the ISO 27001 Toolkit.
The main lesson learnt from organisations that have implemented and complied successfully with Annex A 5.29 is to replicate the same level of information security during a disruption as you have in normal operations and to test it so you can show it is in place.
You can monitor the effectiveness of Annex A 5.29 in a number of ways. The most common ways are:
You have a process of internal audit that audits Annex A 5.9 on a periodic basis
Your business continuity test include a root cause and lessons step that allows you to check that everything worked as intended identify opportunities for improvement.
Accountability for ISO 27001 Annex A 5.29 lies with the senior leadership team. Responsibility is often assigned to the business continuity manager.
The main consequence is that you abandon the good controls that you have in place for normal operations and those lack of controls lead to a breach that impacts your revenue, customers, clients, operations or ability to comply with the law and regulations.
Not being able to understand or explain what information security controls are in place during a disruption.
You can arrange a free 30 minute ISO 27001 strategy call to get the help with ISO 27001 Annex A 5.29.
Related ISO 27001 Controls
ISO 27001 ICT Readiness For Business Continuity: Annex A 5.30
ISO 27001 Information Security Incident Management Planning and Preparation: Annex A 5.24
Further Reading
The complete guide to ISO/IEC 27002:2022
ISO 27001 Change Management Policy Beginner’s Guide
ISO 27001 Business Continuity Policy Beginner’s Guide
ISO 27001 Controls and Attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Corrective | Confidentiality | Protect | Continuity | Protection |
| Preventive | Integrity | Respond | Resilience | |
| Availability |
