Information security during disruption

What the requirement asks

The organization is to plan how it will keep information security at a suitable level while operations are disrupted. Purpose: protect information and associated assets during disruption. Guidance: work out how security controls need to be adapted during disruption and build security requirements into business continuity management. Develop, put in place, test, review and evaluate plans that keep or restore the security of information supporting critical business processes after an interruption or failure, recovering it to the required level within the required time. Implement and maintain security controls and their supporting systems and tools within the business and ICT continuity plans, processes that keep existing security controls working during disruption, and compensating controls for any that cannot be kept running. Other information: continuity planning may call for security requirements that differ from normal operation depending on the type of disruption; the impact analysis and risk assessment done for continuity should weigh and prioritize loss of confidentiality and integrity as well as availability; ISO 22301, ISO 22313 and ISO/TS 22317 give further guidance. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

During disruption the security controls must still apply. The guidance asks for the continuity plan, the reduced control set, the decision authority and the record of what was relaxed.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep business continuity plans that contain information security requirements and the controls, systems and tools needed during disruption and one live sample together.

Evidence an assessor asks for

• Continuity of securityBusiness continuity plans that contain information security requirements and the controls, systems and tools needed during disruption
• Continuity of securityA documented analysis of which security controls must be adapted during disruption and how
• Continuity of securityCompensating controls defined for security controls that cannot be maintained in disruption
• Continuity of securityContinuity test or exercise results that include restoration of security to the required level and within the required time
• Continuity of securityA business impact analysis that considers loss of confidentiality and integrity, not only availability
• Continuity of securityPlan review and evaluation records after tests and real disruptions

The question an assessor will ask

An assessor will ask for business continuity plans that contain information security requirements and the controls, systems and tools needed during disruption, then trace it to the system it protects. For A.5.29 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Continuity plans restore services but omit security controls such as logging, access control or monitoring
• Emergency workarounds bypass security with no compensating measure
• Exercises test only availability, never the security state after recovery
• The impact analysis ignores confidentiality and integrity

Before the next audit

Before the next audit, check one live sample for this gap: continuity plans restore services but omit security controls such as logging, access control or monitoring.