All 93 controls · Organizational controls
Control 5.30
ICT readiness for business continuity
What ISO/IEC 27002:2022 control 5.30 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
ICT readiness is to be planned, put in place, kept current and tested so that it meets the continuity objectives of the business and the requirements for ICT continuity. Purpose: keep the organization's information and associated assets available during disruption. Guidance: ICT readiness is a key part of both continuity and security management, keeping objectives achievable during disruption. ICT continuity requirements come out of the business impact analysis, which uses impact types and criteria to judge how disruption to activities delivering products and services causes harm over time; the size and duration of impact identify prioritized activities, each given a recovery time objective (RTO), and then the resources those activities need, which also get RTOs and include ICT services. The analysis can be extended to set performance and capacity requirements for ICT systems and, for the information needed, recovery point objectives (RPO) for the information needed. From the impact analysis and risk assessment, the organization chooses ICT continuity strategies covering before, during and after disruption, possibly combining solutions, and builds, implements and tests plans that deliver the required ICT availability in the required time. It should ensure a suitable structure of people with the responsibility, authority and competence to get ready for disruption, limit it and react to it; ICT continuity plans with response and recovery procedures that are regularly exercised and tested and approved by management; and plans that state performance and capacity specifications from the impact analysis, the RTO of each prioritized ICT service with restoration procedures, and the RPO of prioritized information with its restoration procedures. Other information: ICT continuity lets the organization respond to and recover from ICT disruption whatever the cause, keep prioritized activities supplied with ICT, and act before disruption and once an incident that could cause one is detected; ISO/IEC 27031, ISO 22301, ISO 22313 and ISO/TS 22317 give more.
Purpose in the standard’s terms, in our words: Ensures information and associated assets remain available during disruption.
Attribute values in one line: Corrective; Availability; Respond; Continuity; Resilience.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Corrective |
|---|---|
| Information security properties | Availability |
| Cybersecurity concepts | Respond |
| Operational capabilities | Continuity |
| Security domains | Resilience |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- The business impact analysis with prioritized activities, supporting ICT services and their RTOs, and RPOs for required information
- Selected ICT continuity strategies covering before, during and after disruption
- Management-approved ICT continuity plans with response and recovery procedures, capacity specifications, RTOs and RPOs
- Exercise and test reports showing recovery achieved within RTO and RPO, with remediation of shortfalls
- An ICT continuity organization chart with named roles, authority and competence records
- Records of plan maintenance after changes to systems or business priorities
Where audits commonly find gaps
- RTOs and RPOs are set by IT without a business impact analysis
- Plans are approved but recovery has never been tested end to end
- Recovery capacity specifications do not match what prioritized activities actually need
- Cloud and third-party ICT services are left out of the continuity plans
What ISO/IEC 27028 changes for this control
It carries a single control type, corrective, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It is one of the eleven controls added in the 2022 edition, so a register carried over from the previous edition may have no row for it.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.