Contact with authorities

What the control asks

The organization is to set up and keep up working contact with the authorities that are relevant to it. Purpose: allow information security matters to pass properly between the organization and the legal, regulatory and supervisory bodies concerned. Guidance: the organization decides in which circumstances and by whom bodies such as law enforcement, regulators and supervisory authorities are contacted, and how confirmed information security incidents are reported to them promptly. These relationships are also a way to learn what the authorities expect now and plan to expect, for example forthcoming security regulations. Other information: an organization being attacked may ask authorities to act against the source; such contacts support incident management (5.24 to 5.28) and continuity (5.29 and 5.30), help anticipate legal change, and extend to utilities, emergency services, power, telecommunications and water providers and health and safety bodies such as fire services.

Purpose in the standard’s terms, in our words: Ensures information security information flows properly between the organization and legal, regulatory and supervisory authorities.

Attribute values in one line: Preventive, Corrective; Confidentiality, Integrity, Availability; Identify, Protect, Respond, Recover; Governance; Defence, Resilience.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• A register of relevant authorities (law enforcement, regulators, supervisory bodies, utilities, emergency services) with current contact details
• A procedure stating when each authority is contacted, by whom, and the reporting timelines for incidents
• Records of incident notifications made to authorities and their timing
• Records of engagement used to track current and upcoming regulatory expectations
• Evidence the contact register is reviewed and kept up to date
• Links between the contact procedure and the incident response and continuity plans

Where audits commonly find gaps

• Contact details are stale or held only by one individual
• No defined decision point or owner for notifying a regulator, so notifications miss statutory deadlines
• Utilities and emergency services are omitted from the continuity contact list
• Regulatory horizon scanning is not linked to the authority relationships

What ISO/IEC 27028 changes for this control

It carries more than one control type (preventive, corrective), so the register should record each and the evidence that proves each one operates. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (06.1.3) is kept in the register so an older audit file can still be traced. It serves more than one security domain, which is why a domain count taken by row understates the view.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.6 Contact with special interest groups
• 5.7 Threat intelligence
• 5.24 Information security incident management planning and preparation

Read the five attributes All 93 controls