I am going to show you what’s new, give you ISO 27001 templates, an ISO 27001 toolkit, show you examples and do a walkthrough of ISO 27001 Annex A 5.29 Information Security During Disruption.
I am Stuart Barker the ISO 27001 Ninja and using over two decades of experience on hundreds of ISO 27001 audits and ISO 27001 certifications I show you exactly what changed in the ISO 27001:2022 update and exactly what you need to do for ISO 27001 certification.
Table of contents
- What is ISO 27001 Annex A 5.29 Information Security During Disruption?
- ISO 27001 Information Security During Disruption Implementation Guide
- How to comply with ISO 27001 Annex A 5.29
- How to pass an audit of ISO 27001 Annex A 5.29
- Top 3 mistakes people make for Information Security During Disruption
- What will an auditor check for ISO 27001 Annex A 5.29?
- ISO 27001 Information Security During Disruption FAQ
- Matrix of ISO 27001 Controls and Attribute values
- Reference
What is ISO 27001 Annex A 5.29 Information Security During Disruption?
ISO 27001 Annex A 5.29 Information Security During Disruption is an ISO 27001 control that wants you to plan and maintain information security at an appropriate level to you during disruption.
ISO 27001 Annex A 5.29 Purpose
The purpose of ISO 27001 Clause 5.29 is protect information and other associated assets during disruption.
ISO 27001 Annex A 5.29 Definition
The ISO 27001 standard defines ISO 27001 Annex A 5.29 Information Security During Disruption as:
The organisation should plan how to maintain information security at an appropriate level during disruption.
ISO 27001:2022 Annex A 5.29
ISO 27001 Information Security During Disruption Implementation Guide
It is my experience that the best way to implement Annex A 5.29 is to replicate the same level of information security in your business continuity plans, disaster recovery plans and disruption operations. Doing anything else, whilst you may need to and you should, will lead to a more complex environment open to a greater level of questioning come your audits.
The Most Ruthlessly Effective and Aggressively Priced ISO 27001 Toolkit in the World.
Join over 1,500+ Empowered Consultants & Business Owners
How to comply with ISO 27001 Annex A 5.29
To comply with ISO 27001 Annex A 5.29 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:
- Have an ISO 27001 topic specific policy for business continuity
- Implement a process for business continuity and disaster recovery
- Incorporate that process into your business operations
How to pass an audit of ISO 27001 Annex A 5.29
To pass an audit of ISO 27001 Annex A 5.29 you are going to make sure that you have followed the steps above in how to comply and be able to evidence it in operation.
- Have a business continuity plan and disaster recovery plan
- Include in the plans the requirements for information security and what is different to normal operation
- Test the plans
- Test the information security requirements are in place as designed
You are going to check that it is working by first conducting an internal audit, following the How to Conduct an ISO 27001 Internal Audit Guide.
Top 3 mistakes people make for Information Security During Disruption
The most common mistakes people make for ISO 27001 Annex A 5.29 are
1. Not having a documented disaster recovery and business continuity policy and plans.
This is the most common mistake made by organisations. Documentation is essential for effective incident response.
2. Not including information security requirements in the plans
There are so many mistakes that can be made but this particular requirement is about information security in a disruption so be sure you understand it and can talk to it and evidence it.
3. Not Testing
It is important to monitor its effectiveness of the information security during a disruption. This means reviewing the process, conducting internal audits and reviewing actual incidents for lessons learnt. The number one thing to do it test and be able to evidence the test.
By avoiding these mistakes, you can ensure that you have an effective collection of evidence plan in place.
What will an auditor check for ISO 27001 Annex A 5.29?
The audit is going to check a number of areas. Lets go through the main ones
1. That you have documented your business continuity and disaster recovery plans
The audit will check the documentation, that you have reviewed it and signed and it off and that it represents what you actually do not what you think they want to hear.
2. That you can demonstrate the process working
They are going to ask you for evidence to the information security during a disruption and take at least one example. For this example you are going to show them and walk them through the process and prove that you followed it and that the process worked.
3. That you can learn your lesson
Documenting your lessons learnt and following this through to continual improvements or incident and corrective actions will be checked.
ISO 27001 Information Security During Disruption FAQ
This ISO 27001 controls wants you to implement and maintain information security controls as well as supporting systems and tools in your business continuity and IT recover / continuity plans.
It wants process to maintain existing information security controls during disruption and compensating controls for those occasions where security controls cannot be maintained to the same level.
Other than your ISO 27001 certification requiring it, the following are the top 5 benefits of ISO 27001 Annex A 5.29:
1. You cannot get ISO 27001 certification without it.
2. Improved security: You will have effective information security during a disruption
3. Reduced risk: You will reduce the information security risks of a disruption
4. Improved compliance: Standards and regulations require an effective information security during a disruption be in place
5. Reputation Protection: In the event of a breach having an effective information security during a disruption system in place will reduce the potential for fines and reduce the PR impact of an event
ISO 27001 Annex A 5.29 is important because during a disruption or incident the information security requirements can get lost. Short cuts can happen that compromise information security. Controls that are in production or the normal running of business can get turned off exposing the organisation to significant risk. The guidance in ISO 27001 Annex A 5.29 can help you to develop and implement an effective plan of what to do for information security during a disruption with the greatest chance of success.
All of the business continuity documents that you need are included in the ISO 27001 Toolkit.
The main lesson learnt from organisations that have implemented and complied successfully with Annex A 5.29 is to replicate the same level of information security during a disruption as you have in normal operations and to test it so you can show it is in place.
You can monitor the effectiveness of Annex A 5.29 in a number of ways. The most common ways are:
You have a process of internal audit that audits Annex A 5.9 on a periodic basis
Your business continuity test include a root cause and lessons step that allows you to check that everything worked as intended identify opportunities for improvement.
Accountability for ISO 27001 Annex A 5.29 lies with the senior leadership team. Responsibility is often assigned to the business continuity manager.
The main consequence is that you abandon the good controls that you have in place for normal operations and those lack of controls lead to a breach that impacts your revenue, customers, clients, operations or ability to comply with the law and regulations.
Not being able to understand or explain what information security controls are in place during a disruption.
You can arrange a free 30 minute ISO 27001 strategy call to get the help with ISO 27001 Annex A 5.29.
Yes, there is an online ISO 27001 at ISO 27001 Online.
Matrix of ISO 27001 Controls and Attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Corrective | Confidentiality | Protect | Continuity | Protection |
| Preventive | Integrity | Respond | Resilience | |
| Availability |