If you run a small business, you probably don’t have a dedicated “Compliance Department.” You likely have a Dave. Or a Sarah. And when the internet goes down or a laptop gets stolen, everyone looks at Dave.
ISO 27001 Annex A 5.5: Contact with Authorities is essentially about giving Dave a fighting chance. It ensures that when a security incident escalates beyond “have you tried turning it off and on again,” your team knows exactly who to call for help.
For a small business, this control is not about red tape. It is about survival. Here is how to implement it simply, effectively, and without hiring a lawyer on retainer.
Table of contents
What is Annex A 5.5 Asking For?
The standard requires you to “establish and maintain contact with relevant authorities.”
In a corporate skyscraper, this involves liaising with federal agencies and industry regulators. In a small business, it means knowing who can help you (or who you are legally required to inform) when things go wrong.
Think of it as the “In Case of Emergency” card in your wallet, but for your company data.
Who Count as “Authorities” for a Small Business?
You don’t need a Rolodex of 500 names. For most small businesses, the relevant authorities fall into three simple buckets:
1. The People Who Enforce the Law (Regulators)
If you handle personal data (names, emails, credit cards), you are answering to someone.
- Data Protection: If you are in the UK, this is the ICO. In Europe, it’s your local DPA. In California, it’s the Attorney General. You need their reporting hotline saved.
- Industry Specifics: If you are a Fintech startup, you might need the FCA. If you are in healthcare, you need the HHS (HIPAA).
2. The People Who Stop Crime (Law Enforcement)
If someone breaks into your office and steals the server, you call the police. But what if they break into your cloud server digitally?
Local police often struggle with cybercrime. You should identify the specific Cyber Crime Unit or reporting fraud center in your region. Having their non-emergency number ready saves panic later.
3. The People Who Keep the Lights On (Utilities & Vendors)
This is often overlooked. If your fiber line is cut, who is your contact at the ISP? If the power goes out, who is the utility provider? Annex A 5.5 encourages you to have these operational contacts ready so you can recover quickly.
Step 1: Build Your “Red Book”
You don’t need expensive software to manage this. A simple, secure document (part of your Incident Response Plan) is perfect. Create a table with the following columns:
- Authority Name: (e.g., Information Commissioner’s Office)
- Contact Details: (Phone, Email, Online Portal)
- When to Call: (The “Trigger”)
- Account Number: (If applicable)
If you want to speed this up, Hightable.io offers robust ISO 27001 toolkits that include pre-formatted templates for this exact register. Using a template ensures you don’t forget a critical field that an auditor will look for.
Step 2: Define the “Trigger” (When to Call)
This is where small businesses get into trouble. You don’t want to call the Privacy Regulator because you lost a mouse. But you must call them if you lose a customer list.
Your documentation needs to be clear:
- Scenario A: Phishing email received but not clicked? -> No contact needed.
- Scenario B: Ransomware detected? -> Contact Cyber Crime Unit and Data Regulator within 72 hours.
Step 3: Don’t Let the Numbers Rot
Imagine the building is on fire, you run to the phone list, dial the number… and it says “This number is no longer in service.”
Annex A 5.5 requires you to maintain contact. For a small business, this just means a quick 6-month check. Put a recurring task in your calendar: “Verify Emergency Contacts.” Click the links, check the phone numbers. Document that you did it. The auditor will love you for it.
DO IT YOURSELF
STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS
Common Mistakes to Avoid
The “911” Fallacy: Don’t just list emergency services. They can’t help you with a GDPR breach.
Confusing Authorities with Interest Groups: Annex A 5.5 is for people with legal power. Annex A 5.6 is for forums and support groups. Keep them separate.
Conclusion
Implementing ISO 27001 Annex A 5.5 for a small business isn’t about filling binders with bureaucracy. It’s about ensuring that when a bad day happens, you aren’t alone. You have the numbers, you know the rules, and you can act fast.
Start by identifying your regulators, write down the numbers, and if you need a head start, check out the resources at Hightable.io to get your documentation audit-ready in minutes.
About the author
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.
Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.
As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.
His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.
