Information security during disruption

What the control asks

The organization is to plan how it will keep information security at a suitable level while operations are disrupted. Purpose: protect information and associated assets during disruption. Guidance: work out how security controls need to be adapted during disruption and build security requirements into business continuity management. Develop, put in place, test, review and evaluate plans that keep or restore the security of information supporting critical business processes after an interruption or failure, recovering it to the required level within the required time. Implement and maintain security controls and their supporting systems and tools within the business and ICT continuity plans, processes that keep existing security controls working during disruption, and compensating controls for any that cannot be kept running. Other information: continuity planning may call for security requirements that differ from normal operation depending on the type of disruption; the impact analysis and risk assessment done for continuity should weigh and prioritize loss of confidentiality and integrity as well as availability; ISO 22301, ISO 22313 and ISO/TS 22317 give further guidance.

Purpose in the standard’s terms, in our words: Protects information and associated assets during disruption.

Attribute values in one line: Preventive, Corrective; Confidentiality, Integrity, Availability; Protect, Respond; Continuity; Protection, Resilience.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Business continuity plans that contain information security requirements and the controls, systems and tools needed during disruption
• A documented analysis of which security controls must be adapted during disruption and how
• Compensating controls defined for security controls that cannot be maintained in disruption
• Continuity test or exercise results that include restoration of security to the required level and within the required time
• A business impact analysis that considers loss of confidentiality and integrity, not only availability
• Plan review and evaluation records after tests and real disruptions

Where audits commonly find gaps

• Continuity plans restore services but omit security controls such as logging, access control or monitoring
• Emergency workarounds bypass security with no compensating measure
• Exercises test only availability, never the security state after recovery
• The impact analysis ignores confidentiality and integrity

What ISO/IEC 27028 changes for this control

It carries more than one control type (preventive, corrective), so the register should record each and the evidence that proves each one operates. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (17.1.1, 17.1.2) is kept in the register so an older audit file can still be traced. It serves more than one security domain, which is why a domain count taken by row understates the view.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.37 Documented operating procedures
• 5.5 Contact with authorities
• 5.6 Contact with special interest groups

Read the five attributes All 93 controls