ISO 27001 Annex A 5.29 Information Security During Disruption

Home / ISO 27001 Annex A Controls / ISO 27001 Annex A 5.29 Information Security During Disruption

I am going to show you what’s new, give you ISO 27001 templates, an ISO 27001 toolkit, show you examples and do a walkthrough of ISO 27001 Annex A 5.29 Information Security During Disruption.

I am Stuart Barker the ISO 27001 Ninja and using over two decades of experience on hundreds of ISO 27001 audits and ISO 27001 certifications I show you exactly what changed in the ISO 27001:2022 update and exactly what you need to do for ISO 27001 certification.

What is ISO 27001 Annex A 5.29 Information Security During Disruption?

ISO 27001 Annex A 5.29 Information Security During Disruption is an ISO 27001 control that wants you to plan and maintain information security at an appropriate level to you during disruption.

ISO 27001 Annex A 5.29 Purpose

The purpose of ISO 27001 Clause 5.29 is protect information and other associated assets during disruption.

ISO 27001 Annex A 5.29 Definition

The ISO 27001 standard defines ISO 27001 Annex A 5.29 Information Security During Disruption as:

The organisation should plan how to maintain information security at an appropriate level during disruption.

ISO 27001:2022 Annex A 5.29

DO IT YOURSELF ISO 27001

STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS

ISO 27001 Toolkit Business Edition

Implementation Guide

It is my experience that the best way to implement Annex A 5.29 is to replicate the same level of information security in your business continuity plans, disaster recovery plans and disruption operations. Doing anything else, whilst you may need to and you should, will lead to a more complex environment open to a greater level of questioning come your audits.

How to comply

To comply with ISO 27001 Annex A 5.29 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:

  1. Have an ISO 27001 topic specific policy for business continuity
  2. Implement a process for business continuity and disaster recovery
  3. Incorporate that process into your business operations

How to pass an audit

To pass an audit of ISO 27001 Annex A 5.29 you are going to make sure that you have followed the steps above in how to comply and be able to evidence it in operation.

  1. Have a business continuity plan and disaster recovery plan
  2. Include in the plans the requirements for information security and what is different to normal operation
  3. Test the plans
  4. Test the information security requirements are in place as designed

You are going to check that it is working by first conducting an internal audit, following the How to Conduct an ISO 27001 Internal Audit Guide.

Top 3 mistakes people make

The most common mistakes people make for ISO 27001 Annex A 5.29 are

1. Not having a documented disaster recovery and business continuity policy and plans.

This is the most common mistake made by organisations. Documentation is essential for effective incident response.

2. Not including information security requirements in the plans

There are so many mistakes that can be made but this particular requirement is about information security in a disruption so be sure you understand it and can talk to it and evidence it.

3. Not Testing

It is important to monitor its effectiveness of the information security during a disruption. This means reviewing the process, conducting internal audits and reviewing actual incidents for lessons learnt. The number one thing to do it test and be able to evidence the test.

By avoiding these mistakes, you can ensure that you have an effective collection of evidence plan in place.

What will an auditor check for ISO 27001 Annex A 5.29?

The audit is going to check a number of areas. Lets go through the main ones

1. That you have documented your business continuity and disaster recovery plans

The audit will check the documentation, that you have reviewed it and signed and it off and that it represents what you actually do not what you think they want to hear.

2. That you can demonstrate the process working

They are going to ask you for evidence to the information security during a disruption and take at least one example. For this example you are going to show them and walk them through the process and prove that you followed it and that the process worked.

3. That you can learn your lesson

Documenting your lessons learnt and following this through to continual improvements or incident and corrective actions will be checked.

ISO 27001 Information Security During Disruption FAQ

What are the requirements of ISO 27001 Annex A 5.29?

This ISO 27001 controls wants you to implement and maintain information security controls as well as supporting systems and tools in your business continuity and IT recover / continuity plans.
It wants process to maintain existing information security controls during disruption and compensating controls for those occasions where security controls cannot be maintained to the same level.

What are the Benefits of ISO 27001 Annex A 5.29?

Other than your ISO 27001 certification requiring it, the following are the top 5 benefits of ISO 27001 Annex A 5.29: 
1. You cannot get ISO 27001 certification without it.
2. Improved security: You will have effective information security during a disruption
3. Reduced risk: You will reduce the information security risks of a disruption
4. Improved compliance: Standards and regulations require an effective information security during a disruption be in place
5. Reputation Protection: In the event of a breach having an effective information security during a disruption system in place will reduce the potential for fines and reduce the PR impact of an event

Why is ISO 27001 Annex A 5.29 Important?

ISO 27001 Annex A 5.29 is important because during a disruption or incident the information security requirements can get lost. Short cuts can happen that compromise information security. Controls that are in production or the normal running of business can get turned off exposing the organisation to significant risk. The guidance in ISO 27001 Annex A 5.29 can help you to develop and implement an effective plan of what to do for information security during a disruption with the greatest chance of success.

What are the resources available to help me with ISO 27001 Annex A 5.29?

All of the business continuity documents that you need are included in the ISO 27001 Toolkit.

What are the lessons learned from organisations that have successfully complied with ISO 27001 Annex A 5.29?

The main lesson learnt from organisations that have implemented and complied successfully with Annex A 5.29 is to replicate the same level of information security during a disruption as you have in normal operations and to test it so you can show it is in place.

How can I monitor the effectiveness of my ISO 27001 Annex A 5.29 implementation?

You can monitor the effectiveness of Annex A 5.29 in a number of ways. The most common ways are:
You have a process of internal audit that audits Annex A 5.9 on a periodic basis
Your business continuity test include a root cause and lessons step that allows you to check that everything worked as intended identify opportunities for improvement.

Who is responsible for ISO 27001 Annex A 5.29?

Accountability for ISO 27001 Annex A 5.29 lies with the senior leadership team. Responsibility is often assigned to the business continuity manager.

What are the consequences of not implementing ISO 27001 Annex A 5.29?

The main consequence is that you abandon the good controls that you have in place for normal operations and those lack of controls lead to a breach that impacts your revenue, customers, clients, operations or ability to comply with the law and regulations.

What are examples of a violation of ISO 27001 Annex A 5.29?

Not being able to understand or explain what information security controls are in place during a disruption.

Where can I get help with ISO 27001 Annex A 5.29?

You can arrange a free 30 minute ISO 27001 strategy call to get the help with ISO 27001 Annex A 5.29.

Is there an online ISO 27001?

Yes, there is an online ISO 27001 at ISO 27001 Online.

Matrix of ISO 27001 Controls and Attribute values

Control typeInformation
security properties
Cybersecurity
concepts
Operational
capabilities
Security domains
CorrectiveConfidentialityProtectContinuityProtection
PreventiveIntegrityRespondResilience
Availability
ISO 27001 Toolkit Business Edition

Do It Yourself ISO27001

Stop Spanking £10,000s on consultants and ISMS online-tools.