ISO 27001:2022 Annex A 5.29 Information security during disruption

In this guide, I will show you exactly how to implement ISO 27001 Annex A 5.29 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy.

I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience conducting hundreds of audits. I will cut through the jargon to show you exactly what changed in the 2022 update and provide you with plain-English advice to get you certified.

Key Takeaways: ISO 27001 Annex A 5.29 Information Security During Disruption

ISO 27001 Annex A 5.29 requires organizations to plan how to maintain information security at an appropriate level during a disruption. When an outage or business continuity event occurs, security controls often get bypassed in the rush to restore operations. This corrective and preventive control ensures that your security posture remains intact even during a crisis. The objective is to prevent “security shortcuts” that could lead to a data breach while the organization is already vulnerable.

Core requirements for compliance include:

• Security Integration in BCP/DR: You must explicitly include information security requirements within your Business Continuity Plans (BCP) and Disaster Recovery (DR) procedures.
• Maintenance of Controls: You should aim to replicate the same level of security during a disruption as you have in normal operations. If a primary control (e.g., SSO) fails, a pre-approved Fallback Control must be ready.
• Continuity of Confidentiality & Integrity: While the focus of BCP is often on Availability, this control mandates that Confidentiality and Integrity are not sacrificed to get systems back online.
• Testing and Validation: It is not enough to have a plan; you must test it. Your business continuity exercises should include a step to verify that security controls are functioning correctly in the fallback environment.
• Lessons Learned: Following any disruption or test, you must conduct a review to identify where security was compromised and update your plans accordingly (Annex A 5.27).

Audit Focus: Auditors will look for “The Security Continuity Trail”:

1. Plan Consistency: “Show me your Business Continuity Plan. Where does it describe the security controls that remain active during a failover?”
2. Test Evidence: “Show me the results of your last disaster recovery test. How did you verify that data encryption and access logs were still active in the secondary environment?”
3. Fallback Awareness: “If your primary VPN fails, how do staff access systems securely? What specific instructions are given to them to maintain security during this time?”

Fallback Security Checklist (Audit Prep):

Scenario	Primary Control (Normal)	Fallback Control (Disruption)
System Access	Single Sign-On (SSO).	Emergency Admin Accounts (Securely stored).
Data Entry	Encrypted Cloud Database.	Secure Paper Forms (Must be locked in safe).
Remote Access	Corporate VPN + MFA.	5G Dongles (Must have hardware firewall).
Physical Site	Electronic Badge Readers.	Physical Guards + Manual Sign-in Logs.

What is ISO 27001 Annex A 5.29?

ISO 270001 Annex A 5.29 is Information Security During Disruption and this rule is about ensuring that information security is maintained during a disruption, outage or business continuity event.

ISO 27001 Annex A 5.29 Information Security During Disruption is an ISO 27001 control that wants you to plan and maintain information security at an appropriate level to you during disruption.

What is the purpose of ISO 27001 Annex 5.29?

The purpose of ISO 27001 Clause 5.29 is protect information and other associated assets during disruption.

What is the definition of ISO 27001 Annex 5.29?

The ISO 27001 standard defines ISO 27001 Annex A 5.29 as:

The organisation should plan how to maintain information security at an appropriate level during disruption.

ISO 27001:2022 Annex A 5.29 Information Security During Disruption

Watch the ISO 27001 Annex A 5.29 Tutorial

In this video I show you how to implement ISO 27001 Annex A 5.29 and how to pass the audit.

ISO 27001 Annex A 5.29 Podcast

In this episode: Lead Auditor Stuart Barker and team do a deep dive into the ISO 27001 Annex A 5.29 Information Security During Disruption. The podcast explores what it is, why it is important and the path to compliance.

How to implement ISO 27001 Annex A 5.29

It is my experience that the best way to implement Annex A 5.29 is to replicate the same level of information security in your business continuity plans, disaster recovery plans and disruption operations. Doing anything else, whilst you may need to and you should, will lead to a more complex environment open to a greater level of questioning come your audits.

Fallback Security Checklist

Scenario	Primary Control (Normal)	Fallback Control (Disruption)
System Access	Single Sign-On (SSO).	Emergency Admin Accounts (in sealed envelope).
Data Entry	Encrypted Database.	Paper Forms (Must be locked in safe).
Remote Access	VPN + MFA.	5G Dongles (Must have corporate firewall).
Physical Site	Electronic Badges.	Physical Guards + Manual Sign-in Log.

How to comply

To comply with ISO 27001 Annex A 5.29 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:

1. Have an ISO 27001 topic specific policy for business continuity
2. Implement a process for business continuity and disaster recovery
3. Incorporate that process into your business operations

How to pass an ISO 27001 Annex A 5.29 audit

To pass an audit of ISO 27001 Annex A 5.29 you are going to make sure that you have followed the steps above in how to comply and be able to evidence it in operation.

1. Have a business continuity plan and disaster recovery plan
2. Include in the plans the requirements for information security and what is different to normal operation
3. Test the plans
4. Test the information security requirements are in place as designed

What will an auditor check for ISO 27001 Annex A 5.29?

The audit is going to check a number of areas. Lets go through the main ones

1. That you have documented your business continuity and disaster recovery plans

The audit will check the documentation, that you have reviewed it and signed and it off and that it represents what you actually do not what you think they want to hear.

2. That you can demonstrate the process working

They are going to ask you for evidence to the information security during a disruption and take at least one example. For this example you are going to show them and walk them through the process and prove that you followed it and that the process worked.

3. That you can learn your lesson

Documenting your lessons learnt and following this through to continual improvements or incident and corrective actions will be checked.

Top 3 ISO 27001 Annex A 5.29 mistakes people make and how to avoid them

The most common mistakes people make for ISO 27001 Annex A 5.29 are

1. Not having a documented disaster recovery and business continuity policy and plans.

This is the most common mistake made by organisations. Documentation is essential for effective incident response.

2. Not including information security requirements in the plans

There are so many mistakes that can be made but this particular requirement is about information security in a disruption so be sure you understand it and can talk to it and evidence it.

3. Not Testing

It is important to monitor its effectiveness of the information security during a disruption. This means reviewing the process, conducting internal audits and reviewing actual incidents for lessons learnt. The number one thing to do it test and be able to evidence the test.

By avoiding these mistakes, you can ensure that you have an effective collection of evidence plan in place.

Fast Track ISO 27001 Annex A 5.29 Compliance with the ISO 27001 Toolkit

---

Own Your ISMS, Don’t Rent It

Do it Yourself ISO 27001 with the Ultimate ISO 27001 Toolkit

---

For ISO 27001 Annex A 5.29 (Information security during disruption), the requirement is to plan how to maintain information security at an appropriate level during a disruption. This ensures that when your primary systems go down, you don’t abandon your security controls (like encryption or access logs) just to keep the business running.

While SaaS compliance platforms often try to sell you “automated disaster recovery (DR) tracking” or complex “uptime dashboards,” they cannot actually physically hand over emergency admin credentials in a sealed envelope or ensure a physical guard is following a manual sign-in log during a power outage, those are human governance and operational tasks. The High Table ISO 27001 Toolkit is the logical choice because it provides the resilience framework you need to maintain security during chaos without a recurring subscription fee.

1. Ownership: You Own Your Resilience Plans Forever

SaaS platforms act as a middleman for your compliance evidence. If you define your fallback security controls and store your DR test results inside their proprietary system, you are essentially renting your own survival strategy.

• The Toolkit Advantage: You receive the Business Continuity Policy and Disaster Recovery Plan templates in fully editable Word/Excel formats. These files are yours forever. You maintain permanent ownership of your standards (such as your specific “Fallback Security Checklist”), ensuring you are always ready for an audit without an ongoing “rental” fee.

2. Simplicity: Governance for Real-World Disruption

Annex A 5.29 is about maintaining security when things go wrong. You don’t need a complex new software interface to manage what a robust backup strategy or a well-documented manual fallback process already does perfectly.

• The Toolkit Advantage: Your team already knows they need to keep working during an outage. What they need is the governance layer to prove to an auditor that security isn’t “turned off” during a crisis. The Toolkit provides pre-written procedures and “Fallback Security Checklists” that formalize your existing DR work into an auditor-ready framework, without forcing your team to learn a new software platform just to log an emergency access event.

3. Cost: A One-Off Fee vs. The “Disaster” Tax

Many compliance SaaS platforms charge more based on the number of “continuity plans” or “incident simulations” you run. For a control that is essential to your business’s survival, these monthly costs can scale aggressively.

• The Toolkit Advantage: You pay a single, one-off fee for the entire toolkit. Whether you test your plan once a year or ten times, the cost of your Security in Disruption Documentation remains the same. You save your budget for actual resilience technology (like redundant servers or failover sites) rather than an expensive compliance dashboard.

4. Freedom: No Vendor Lock-In for Your Continuity Strategy

SaaS tools often mandate specific ways to report on and monitor security during disruption. If their system doesn’t match your unique physical office setup or specialized offline processes, the tool becomes a bottleneck to true resilience.

• The Toolkit Advantage: The High Table Toolkit is 100% technology-agnostic. You can tailor the Disruption Procedures to match exactly how you operate, whether you use high-end cloud failover or simple, risk-managed paper forms. You maintain total freedom to evolve your continuity strategy without being constrained by the technical limitations of a rented SaaS platform.

Summary: For Annex A 5.29, the auditor wants to see that you have a formal plan for maintaining security during a disruption and proof that you have tested it (e.g., test logs and evidence of fallback controls). The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.

ISO 27001 Annex A 5.29 FAQ

Related ISO 27001 Controls

ISO 27001 Annex A 5.30 ICT Readiness For Business Continuity

ISO 27001 Annex A 5.24 Information Security Incident Management Planning and Preparation

Further Reading

The complete guide to ISO/IEC 27002:2022

ISO 27001 Change Management Policy Beginner’s Guide

ISO 27001 Business Continuity Policy Beginner’s Guide

ISO 27001 Controls and Attribute values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Corrective	Confidentiality	Protect	Continuity	Protection
Preventive	Integrity	Respond		Resilience
	Availability

About the author

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.

Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.

As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.

His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.