ISO 27001:2022 Annex A 5.5 Contact with Authorities for SMEs

In this guide, I will show you exactly how small businesses and SMEs can implement ISO 27001:2022 Annex A 5.5 Contact with authorities without the enterprise-level complexity. You will get a complete walkthrough of the control tailored for organizations with limited resources, along with practical examples and access to ISO 27001 templates that make compliance easy.

I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience auditing businesses of all sizes. I will cut through the jargon to show you exactly what changed in the 2022 update and provide the plain-English advice you need to get your small business certified.

Key Takeaways: ISO 27001 Annex A 5.5 Contact with Authorities (SME Edition)

For Small and Medium-sized Enterprises (SMEs), ISO 27001 Annex A 5.5 is your emergency contact list. It ensures that when a security incident escalates beyond a simple technical fix, your team knows exactly who to call. This control is not about red tape; it is about survival. It prevents the panic of trying to find the right number for a regulator or cyber crime unit while a data breach is actively happening.

Core requirements for compliance include:

• Identify Relevant Authorities: You do not need a list of every agency on earth. Focus on the ones that can fine you (Regulators), help you (Law Enforcement), or keep your business running (Utilities).
• Define the “Trigger”: Your staff need to know when to call. You do not call the Information Commissioner’s Office (ICO) for a lost mouse, but you must call them within 72 hours for a serious data breach.
• Keep it Current: A list of dead numbers is useless. You must review and verify contact details regularly (e.g. every 6 months) to ensuring they still work.
• Operational Contacts: Do not forget your utility providers. If your fibre line is cut, knowing your ISP’s priority support number is just as critical as knowing the police number.
• Distinction from Annex A 5.6: Annex A 5.5 is for authorities with legal power (Police/Regulators). Annex A 5.6 is for special interest groups (Forums/Support). Keep them separate.

Audit Focus: Auditors will look for “The Fire Drill”:

1. The List: “Show me your contact list for authorities. Is the number for the ICO correct?”
2. The Scenario: “If you had a ransomware attack right now that leaked customer data, who would you call first? Show me where that is written down.”
3. Maintenance: “When was the last time someone actually checked that these phone numbers work?”

SME Authority Matrix (Audit Prep):

Authority Type	Example	When to Contact (The Trigger)
Regulator	ICO (UK) / DPA (EU).	Data breach affecting personal data (72hr rule).
Law Enforcement	Action Fraud / Cyber Crime Unit.	Ransomware, fraud, or criminal damage.
Utility / Vendor	ISP / Cloud Provider (AWS).	Major outage or service disruption.
Insurance	Cyber Insurance Provider.	Immediately upon discovering a significant incident.

What is ISO 27001 Annex A 5.5 for SMEs?

The standard requires you to “establish and maintain contact with relevant authorities.”

In a corporate skyscraper, this involves liaising with federal agencies and industry regulators. In a small business, it means knowing who can help you (or who you are legally required to inform) when things go wrong.

Think of it as the “In Case of Emergency” card in your wallet, but for your company data.

Who Count as “Authorities” for a Small Business?

You don’t need a Rolodex of 500 names. For most small businesses, the relevant authorities fall into three simple buckets:

1. The People Who Enforce the Law (Regulators)

If you handle personal data (names, emails, credit cards), you are answering to someone.

• Data Protection: If you are in the UK, this is the ICO. In Europe, it’s your local DPA. In California, it’s the Attorney General. You need their reporting hotline saved.
• Industry Specifics: If you are a Fintech startup, you might need the FCA. If you are in healthcare, you need the HHS (HIPAA).

2. The People Who Stop Crime (Law Enforcement)

If someone breaks into your office and steals the server, you call the police. But what if they break into your cloud server digitally?

Local police often struggle with cybercrime. You should identify the specific Cyber Crime Unit or reporting fraud center in your region. Having their non-emergency number ready saves panic later.

3. The People Who Keep the Lights On (Utilities & Vendors)

This is often overlooked. If your fibre line is cut, who is your contact at the ISP? If the power goes out, who is the utility provider? Annex A 5.5 encourages you to have these operational contacts ready so you can recover quickly.

Step 1: Build Your “Red Book”

You don’t need expensive software to manage this. A simple, secure document (part of your Incident Response Plan) is perfect. Create a table with the following columns:

• Authority Name: (e.g., Information Commissioner’s Office)
• Contact Details: (Phone, Email, Online Portal)
• When to Call: (The “Trigger”)
• Account Number: (If applicable)

If you want to speed this up, Hightable.io offers robust ISO 27001 toolkits that include pre-formatted templates for this exact register. Using a template ensures you don’t forget a critical field that an auditor will look for.

Step 2: Define the “Trigger” (When to Call)

This is where small businesses get into trouble. You don’t want to call the Privacy Regulator because you lost a mouse. But you must call them if you lose a customer list.

Your documentation needs to be clear:

• Scenario A: Phishing email received but not clicked? -> No contact needed.
• Scenario B: Ransomware detected? -> Contact Cyber Crime Unit and Data Regulator within 72 hours.

Step 3: Don’t Let the Numbers Rot

Imagine the building is on fire, you run to the phone list, dial the number… and it says “This number is no longer in service.”

Annex A 5.5 requires you to maintain contact. For a small business, this just means a quick 6-month check. Put a recurring task in your calendar: “Verify Emergency Contacts.” Click the links, check the phone numbers. Document that you did it. The auditor will love you for it.

Common ISO 27001 Annex A 5.5 Mistakes SMEs Make and How to Avoid Them

• The “911” Fallacy: Don’t just list emergency services. They can’t help you with a GDPR breach.
• Confusing Authorities with Interest Groups: Annex A 5.5 is for people with legal power. Annex A 5.6 is for forums and support groups. Keep them separate.

Fast Track ISO 27001 Annex A 5.5 Compliance for SMEs with the ISO 27001 Toolkit

For Small Businesses and SMEs, ISO 27001 Annex A 5.5 (Contact with authorities) is your company’s “In Case of Emergency” card. It ensures that when a security incident escalates, your team knows exactly who to call, whether it is a data regulator like the ICO, law enforcement for cybercrime, or critical utility providers. This control is about survival, ensuring you aren’t alone on your worst business day.

While SaaS compliance platforms often try to sell you “integrated contact databases” or complex “regulatory reporting workflows”, they cannot actually pick up the phone for you or ensure your team knows the specific “trigger” for when a call is legally required. Those are human governance and operational tasks. The High Table ISO 27001 Toolkit is the logical choice for SMEs because it provides the emergency framework you need without a recurring subscription fee.

1. Ownership: You Own Your Emergency Contact List Forever

SaaS platforms act as a middleman for your compliance evidence. If you define your regulatory contacts and store your incident triggers inside their proprietary system, you are essentially renting your own business recovery plan.

• The Toolkit Advantage: You receive the Authorities Contact Register and Incident Response Plan templates in fully editable Word and Excel formats. These files are yours forever. You maintain permanent ownership of your records, such as your specific history of verifying emergency numbers, ensuring you are always ready for an audit without an ongoing “rental” fee.

2. Simplicity: Governance for Rapid Emergency Action

Annex A 5.5 is about being prepared. You do not need a complex new software interface to manage what a well-structured “Red Book” document and a simple 6-month calendar reminder already do perfectly.

• The Toolkit Advantage: SMEs need to act fast during a breach. What they need is the governance layer to prove to an auditor that they know who to call and when. The Toolkit provides pre-formatted templates that define the “Triggers” for when to contact authorities, without forcing your team to learn a new software platform just to look up a phone number.

3. Cost: A One-Off Fee vs. The “Compliance” Tax

Many compliance SaaS platforms charge more based on the number of “regulatory modules” or “active responders” you track. For an SME, these monthly costs can scale aggressively for very little added value.

• The Toolkit Advantage: You pay a single, one-off fee for the entire toolkit. Whether you track 5 authorities or 15, the cost of your Authorities Documentation remains the same. You save your budget for actual security measures rather than an expensive compliance dashboard.

4. Freedom: No Vendor Lock-In for Your Recovery Strategy

SaaS tools often mandate specific ways to report on and monitor “contact with authorities”. If their system does not match your unique business model or specialised industry requirements, such as sector-specific Fintech or Healthcare regulators, the tool becomes a bottleneck to efficiency.

• The Toolkit Advantage: The High Table Toolkit is 100% technology-agnostic. You can tailor the Contact Procedures to match exactly how you operate, whether you use formal legal hotlines or simple, risk-managed vendor support. You maintain total freedom to evolve your recovery strategy without being constrained by the technical limitations of a rented SaaS platform.

Summary: For SMEs, the auditor wants to see a live “Red Book” register of authorities with clear triggers for contact and proof of regular verification (e.g. a simple 6-month check log). The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.

Conclusion

Implementing ISO 27001 Annex A 5.5 for a small business isn’t about filling binders with bureaucracy. It’s about ensuring that when a bad day happens, you aren’t alone. You have the numbers, you know the rules, and you can act fast.

Start by identifying your regulators, write down the numbers, and if you need a head start, check out the resources at Hightable.io to get your documentation audit-ready in minutes.