The ultimate audit guide to ISO 27001 Annex A 5.5 Contact with authorities
Table of contents
- 1. List of Relevant Regulatory Authorities Verified
- 2. Defined Trigger Points for Authority Notification Confirmed
- 3. Designated Liaison Personnel Identification Validated
- 4. Authority Contact Information Accuracy Verified
- 5. Reporting Timelines Alignment with Legal Requirements Confirmed
- 6. Secure Communication Channels for Sensitive Reporting Verified
- 7. Evidence of Past Regulatory Interactions (If Applicable) Validated
- 8. Regulatory Update Monitoring Process Confirmed
- 9. Internal Escalation Path to Liaison Role Verified
- 10. Authority Contact Log Integrity Validated
1. List of Relevant Regulatory Authorities Verified
Verification Criteria: A maintained register exists identifying all legal, regulatory, and supervisory bodies relevant to the organisation’s industry and jurisdiction.
Required Evidence: Legal and Regulatory Register or an “Authorities Contact List” within the ISMS documentation.
Pass/Fail Test: If the organisation cannot produce a list of specific authorities (e.g., ICO for UK GDPR, FCA for finance) relevant to their ISMS scope, mark as Non-Compliant.
2. Defined Trigger Points for Authority Notification Confirmed
Verification Criteria: Internal procedures explicitly define the specific security incidents or legal requirements that necessitate immediate contact with authorities.
Required Evidence: Incident Response Plan (IRP) or Data Breach Notification Policy containing specific “thresholds” for reporting.
Pass/Fail Test: If the documentation lacks binary criteria for when an incident must be escalated to an external body, mark as Non-Compliant.
3. Designated Liaison Personnel Identification Validated
Verification Criteria: Specific roles (e.g., DPO, CISO, Legal Counsel) are formally designated as the sole points of contact for interacting with authorities.
Required Evidence: Responsibility Assignment Matrix (RACI) or Job Descriptions specifying “Authority Liaison” duties.
Pass/Fail Test: If any staff member can contact a regulator regarding a security event without a formal internal approval path, mark as Non-Compliant.
4. Authority Contact Information Accuracy Verified
Verification Criteria: Contact details for relevant authorities (phone numbers, portal links, emergency emails) are current and verified within the last 12 months.
Required Evidence: The “Authorities Contact List” showing a “Last Verified” date and valid, non-generic contact points.
Pass/Fail Test: If contact details for a primary regulator are found to be disconnected or significantly outdated, mark as Non-Compliant.
5. Reporting Timelines Alignment with Legal Requirements Confirmed
Verification Criteria: Internal reporting deadlines (e.g., 72 hours for GDPR) are documented and align with the statutory requirements of the relevant jurisdictions.
Required Evidence: Data Protection Policy or Regulatory Compliance Framework documenting specific hourly/daily windows for notification.
Pass/Fail Test: If internal policy allows for notification windows that exceed legal requirements (e.g., “within 7 days” for a 72-hour requirement), mark as Non-Compliant.
6. Secure Communication Channels for Sensitive Reporting Verified
Verification Criteria: The organisation has identified and tested secure methods for transmitting sensitive breach data to authorities (e.g., encrypted portals).
Required Evidence: Screenshots of bookmarked regulatory portals or documented instructions for using encrypted communication for reporting.
Pass/Fail Test: If the only method for reporting a high-sensitivity breach is via unencrypted standard email, mark as Non-Compliant.
7. Evidence of Past Regulatory Interactions (If Applicable) Validated
Verification Criteria: If incidents occurred, the organisation must show that authorities were contacted within the required timeframe and through the correct channels.
Required Evidence: Incident logs, submission receipts from regulatory portals, or email threads with external legal counsel/authorities.
Pass/Fail Test: If a reportable incident occurred but no record of communication with the relevant authority exists, mark as Non-Compliant.
8. Regulatory Update Monitoring Process Confirmed
Verification Criteria: A proactive process is in place to monitor changes in legislation or authority requirements that might affect the ISMS.
Required Evidence: Subscription logs to regulatory newsletters, minutes from legal update meetings, or entries in a “Change in Law” log.
Pass/Fail Test: If the organisation has no systematic way to identify when a regulator changes its reporting requirements, mark as Non-Compliant.
9. Internal Escalation Path to Liaison Role Verified
Verification Criteria: Staff members know how to report an event internally so that the designated liaison can determine if authority contact is needed.
Required Evidence: Staff awareness training records or an internal “Whistleblowing/Reporting” flowchart.
Pass/Fail Test: If a sample of staff cannot identify the person or department responsible for regulatory reporting, mark as Non-Compliant.
10. Authority Contact Log Integrity Validated
Verification Criteria: A central log is maintained to record all instances of contact with authorities, including the date, reason, and outcome.
Required Evidence: “Regulatory Contact Log” or a filtered view of the Incident Management System showing “External Reporting” actions.
Pass/Fail Test: If communications with authorities are stored only in individual email inboxes without a central record, mark as Non-Compliant.
About the author
