ISO 27001 A.5.29 - Information Security During Disruption

Requirement

“The organization shall plan how to maintain information security at an appropriate level during disruption.”

Plain-language meaning

The organization must decide in advance how information security will be maintained during serious disruption, crisis, disaster recovery, or business continuity events.

Why this matters

Disruption is exactly when people bypass normal controls, use emergency access, move data quickly, depend on suppliers, or restore services under pressure. If security drops too far, a continuity event can become a security incident.

Implementation guidance

1. Define information security continuity objectives for crisis and recovery situations.
2. Include information security requirements in business continuity, crisis management, disaster recovery, and business impact analysis activities.
3. Identify minimum acceptable controls during disruption, including access control, logging, backup protection, communications security, supplier security, data handling, and emergency changes.
4. Assign responsibilities between information security, business continuity, disaster recovery, IT, suppliers, management, legal, and communications roles.
5. Verify that suppliers business continuity arrangements maintain security at a level that meets organizational requirements.
6. Test or exercise continuity plans with information security responsibilities included, not only operational recovery tasks.

Audit guidance

Auditors should verify that continuity plans include explicit information security objectives, risk assessment, management approval, assigned responsibilities, documented procedures, awareness, and testing evidence.

Evidence examples

Strong evidence

• Documented information security continuity objectives are approved by management.
• Business impact analysis includes security requirements, not only recovery timing.
• Continuity and disaster recovery plans include access control, communications, supplier, data protection, and emergency change controls.
• Security and continuity specialists both contributed to plan design or review.
• Continuity exercises include information security scenarios and responsibilities.
• Supplier continuity arrangements are reviewed for security adequacy.

Weak evidence

• Continuity plan focuses only on restoring operations.
• Security is assumed to continue but not specified.
• Emergency access is allowed without approval, logging, or review.
• Supplier continuity plans are accepted without checking security requirements.
• Staff with crisis roles cannot explain security responsibilities.
• Continuity testing ignores security decisions.

Common failures

Exam traps

• A.5.29 is about maintaining appropriate security during disruption, not just restoring availability.
• Business continuity and disaster recovery plans should include information security requirements.
• A crisis can create both continuity and security incidents if controls are bypassed.
• Supplier continuity arrangements should meet the organization security requirements.
• Testing matters because complex plans rarely work perfectly the first time.

Related controls and concepts

• A.5.24 Information Security Incident Management Planning and Preparation
• A.5.30 ICT Readiness for Business Continuity
• Risk Assessment
• Management Review
• Internal Audit
• Supplier Security Register
• Cloud Security Requirements and Exit Checklist

KB-ready summary

A.5.29 requires the organization to make continuity practical for information security. The key test is whether disruption plans, ICT recovery, suppliers, roles, tests, and improvement actions preserve the right level of security while restoring priority services.

Templates and checklists

• Information Security Continuity Requirements
• A.5.29 Audit Checklist