A.5.29 Audit Evidence Pack

What the auditor wants to verify

The auditor wants to confirm that information security is maintained at an appropriate level during disruption and that continuity plans include security objectives, roles, requirements, supplier considerations, and testing.

Evidence to request

Strong evidence

• Documented information security continuity objectives are approved by management.
• Business impact analysis includes security requirements, not only recovery timing.
• Continuity and disaster recovery plans include access control, communications, supplier, data protection, and emergency change controls.
• Security and continuity specialists both contributed to plan design or review.
• Continuity exercises include information security scenarios and responsibilities.
• Supplier continuity arrangements are reviewed for security adequacy.

Weak evidence

• Continuity plan focuses only on restoring operations.
• Security is assumed to continue but not specified.
• Emergency access is allowed without approval, logging, or review.
• Supplier continuity plans are accepted without checking security requirements.
• Staff with crisis roles cannot explain security responsibilities.
• Continuity testing ignores security decisions.

Sample interview questions

• What security objectives apply during disruption?
• Where are security requirements captured in business continuity planning?
• Who owns security decisions during crisis response?
• How are supplier continuity arrangements checked for security adequacy?
• Show a continuity test where information security responsibilities were exercised.

Common nonconformities

• Business continuity plans restore service but weaken access control
• Emergency workarounds are undocumented
• Security team is not involved in continuity planning
• Supplier continuity arrangements are not reviewed
• Plans are untested

Related notes

• A.5.29 Information Security During Disruption
• Information Security Continuity Requirements
• A.5.29 Audit Checklist