ISO 27001 Information Security During Disruption
ISO 270001 Annex A 5.29 is Information Security During Disruption and this rule is about ensuring that information security is maintained during a disruption, outage or business continuity event.
Table of contents
- ISO 27001 Information Security During Disruption
- What is ISO 27001 Annex A 5.29 ?
- Implementation Guide
- Watch the ISO 27001 Annex A 5.29 Tutorial
- How to comply
- How to pass an audit
- What will an auditor check for ISO 27001 Annex A 5.29?
- Top 3 mistakes people make
- ISO 27001 Annex A 5.29 FAQ
- Related ISO 27001 Controls
- Further Reading
- ISO 27001 Controls and Attribute values
What is ISO 27001 Annex A 5.29 ?
ISO 27001 Annex A 5.29 Information Security During Disruption is an ISO 27001 control that wants you to plan and maintain information security at an appropriate level to you during disruption.
What is the purpose of ISO 27001 Annex 5.29?
The purpose of ISO 27001 Clause 5.29 is protect information and other associated assets during disruption.
What is the definition of ISO 27001 Annex 5.29?
The ISO 27001 standard defines ISO 27001 Annex A 5.29 as:
The organisation should plan how to maintain information security at an appropriate level during disruption.
ISO 27001:2022 Annex A 5.29 Information Security During Disruption
DO IT YOURSELF ISO 27001
STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS
Implementation Guide
It is my experience that the best way to implement Annex A 5.29 is to replicate the same level of information security in your business continuity plans, disaster recovery plans and disruption operations. Doing anything else, whilst you may need to and you should, will lead to a more complex environment open to a greater level of questioning come your audits.
Watch the ISO 27001 Annex A 5.29 Tutorial
In this video I show you how to implement ISO 27001 Annex A 5.29 and how to pass the audit.
How to comply
To comply with ISO 27001 Annex A 5.29 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:
- Have an ISO 27001 topic specific policy for business continuity
- Implement a process for business continuity and disaster recovery
- Incorporate that process into your business operations
How to pass an audit
To pass an audit of ISO 27001 Annex A 5.29 you are going to make sure that you have followed the steps above in how to comply and be able to evidence it in operation.
- Have a business continuity plan and disaster recovery plan
- Include in the plans the requirements for information security and what is different to normal operation
- Test the plans
- Test the information security requirements are in place as designed
What will an auditor check for ISO 27001 Annex A 5.29?
The audit is going to check a number of areas. Lets go through the main ones
1. That you have documented your business continuity and disaster recovery plans
The audit will check the documentation, that you have reviewed it and signed and it off and that it represents what you actually do not what you think they want to hear.
2. That you can demonstrate the process working
They are going to ask you for evidence to the information security during a disruption and take at least one example. For this example you are going to show them and walk them through the process and prove that you followed it and that the process worked.
3. That you can learn your lesson
Documenting your lessons learnt and following this through to continual improvements or incident and corrective actions will be checked.
Top 3 mistakes people make
The most common mistakes people make for ISO 27001 Annex A 5.29 are
1. Not having a documented disaster recovery and business continuity policy and plans.
This is the most common mistake made by organisations. Documentation is essential for effective incident response.
2. Not including information security requirements in the plans
There are so many mistakes that can be made but this particular requirement is about information security in a disruption so be sure you understand it and can talk to it and evidence it.
3. Not Testing
It is important to monitor its effectiveness of the information security during a disruption. This means reviewing the process, conducting internal audits and reviewing actual incidents for lessons learnt. The number one thing to do it test and be able to evidence the test.
By avoiding these mistakes, you can ensure that you have an effective collection of evidence plan in place.
ISO 27001 Annex A 5.29 FAQ
This ISO 27001 controls wants you to implement and maintain information security controls as well as supporting systems and tools in your business continuity and IT recover / continuity plans.
It wants process to maintain existing information security controls during disruption and compensating controls for those occasions where security controls cannot be maintained to the same level.
Other than your ISO 27001 certification requiring it, the following are the top 5 benefits of ISO 27001 Annex A 5.29:
1. You cannot get ISO 27001 certification without it.
2. Improved security: You will have effective information security during a disruption
3. Reduced risk: You will reduce the information security risks of a disruption
4. Improved compliance: Standards and regulations require an effective information security during a disruption be in place
5. Reputation Protection: In the event of a breach having an effective information security during a disruption system in place will reduce the potential for fines and reduce the PR impact of an event
ISO 27001 Annex A 5.29 is important because during a disruption or incident the information security requirements can get lost. Short cuts can happen that compromise information security. Controls that are in production or the normal running of business can get turned off exposing the organisation to significant risk. The guidance in ISO 27001 Annex A 5.29 can help you to develop and implement an effective plan of what to do for information security during a disruption with the greatest chance of success.
All of the business continuity documents that you need are included in the ISO 27001 Toolkit.
The main lesson learnt from organisations that have implemented and complied successfully with Annex A 5.29 is to replicate the same level of information security during a disruption as you have in normal operations and to test it so you can show it is in place.
You can monitor the effectiveness of Annex A 5.29 in a number of ways. The most common ways are:
You have a process of internal audit that audits Annex A 5.9 on a periodic basis
Your business continuity test include a root cause and lessons step that allows you to check that everything worked as intended identify opportunities for improvement.
Accountability for ISO 27001 Annex A 5.29 lies with the senior leadership team. Responsibility is often assigned to the business continuity manager.
The main consequence is that you abandon the good controls that you have in place for normal operations and those lack of controls lead to a breach that impacts your revenue, customers, clients, operations or ability to comply with the law and regulations.
Not being able to understand or explain what information security controls are in place during a disruption.
You can arrange a free 30 minute ISO 27001 strategy call to get the help with ISO 27001 Annex A 5.29.
Related ISO 27001 Controls
ISO 27001 Annex A 5.30 ICT Readiness For Business Continuity
ISO 27001 Annex A 5.24 Information Security Incident Management Planning and Preparation
Further Reading
The complete guide to ISO/IEC 27002:2022
ISO 27001 Change Management Policy Beginner’s Guide
ISO 27001 Business Continuity Policy Beginner’s Guide
ISO 27001 Controls and Attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Corrective | Confidentiality | Protect | Continuity | Protection |
| Preventive | Integrity | Respond | Resilience | |
| Availability |
About the author
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.
Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.
As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.
His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.