Contact with authorities

What the requirement asks

The organization is to set up and keep up working contact with the authorities that are relevant to it. Purpose: allow information security matters to pass properly between the organization and the legal, regulatory and supervisory bodies concerned. Guidance: the organization decides in which circumstances and by whom bodies such as law enforcement, regulators and supervisory authorities are contacted, and how confirmed information security incidents are reported to them promptly. These relationships are also a way to learn what the authorities expect now and plan to expect, for example forthcoming security regulations. Other information: an organization being attacked may ask authorities to act against the source; such contacts support incident management (5.24 to 5.28) and continuity (5.29 and 5.30), help anticipate legal change, and extend to utilities, emergency services, power, telecommunications and water providers and health and safety bodies such as fire services. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Contacts with authorities are expected to be named, current and tested. The guidance asks for the authority, the contact route, the person who may use it and the record of the last contact or exercise.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep A register of relevant authorities (law enforcement, regulators, supervisory bodies, utilities, emergency services) with current contact details and one live sample together.

Evidence an assessor asks for

• Regulatory liaisonA register of relevant authorities (law enforcement, regulators, supervisory bodies, utilities, emergency services) with current contact details
• Regulatory liaisonA procedure stating when each authority is contacted, by whom, and the reporting timelines for incidents
• Regulatory liaisonRecords of incident notifications made to authorities and their timing
• Regulatory liaisonRecords of engagement used to track current and upcoming regulatory expectations
• Regulatory liaisonEvidence the contact register is reviewed and kept up to date
• Regulatory liaisonLinks between the contact procedure and the incident response and continuity plans

The question an assessor will ask

An assessor will ask for A register of relevant authorities (law enforcement, regulators, supervisory bodies, utilities, emergency services) with current contact details, then trace it to the system it protects. For A.5.5 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Contact details are stale or held only by one individual
• No defined decision point or owner for notifying a regulator, so notifications miss statutory deadlines
• Utilities and emergency services are omitted from the continuity contact list
• Regulatory horizon scanning is not linked to the authority relationships

Before the next audit

Before the next audit, check one live sample for this gap: contact details are stale or held only by one individual.