ISO 27001:2022 Annex A 5.29

General Guidance on ISO 27001:2022 Annex A 5.29

ISO 27001:2022 Annex A 5.29 dictates that information security should be an integral part of an organisation’s broader business continuity management plan.

Organisations should create plans to maintain information security and restore it if any interruption of operations or systems failure leads to a breach.

Security levels must be returned to pre-interruption levels in an expeditious manner, so as to prevent any further harm.

Organisations should take the following steps:

1. Implement and sustain general information security measures, including corporate systems and ICT frameworks, as part of the company’s overall continuity plans.
2. Implement procedures that strive to uphold information security measures during any interruption.
3. When applicable, substitute controls should be applied to any information security attempts that cannot be sustained during a disruption.

Supplementary Guidance on Annex A 5.29

ISO 27001:2022 Annex A 5.29 recognises the great variability of continuity planning, granting organisations considerable scope to apply information security controls tailored to the various kinds of business interruption they could encounter.

ISO urges organisations to pay particular attention to two areas when designing a business continuity plan:

• The divulgence of confidential information.
• Ensuring the accuracy, reliability and integrity of information is of utmost importance.

What Are the Changes From ISO 27001:2013?

ISO 27001:2022 Annex A 5.29 supersedes the preceding three directives 17.1.1, 17.1.2 and 17.1.3 from ISO 27001:2013.

• 17.1.1 – Planning information security continuity
• 17.1.2 – Implementing information security continuity
• 17.1.3 – Verify, review and evaluate information security continuity

In acknowledging the intricate complexity of business continuity plans – and how they vary depending on the kind of interruption – ISO have made their guidance simpler by shifting away from a detailed approach and instead requesting that organisations think about a few essential elements when creating plans specific to the subject (see above).

For example, ISO 27001:2013 Annex A 17.1.2 explains:

Personnel responsible for incident response, with the capacity to manage an incident and uphold information security, are assigned.

Despite their importance for effective continuity planning, Section 5.29 does not mention incident response teams specifically, but rather trusts the organisation to consider them carefully when following the guidance notes, particularly in the following areas:

Deploy and maintain security controls for general information, business systems and ICT platforms in line with the organisation’s continuity plans.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Help

ISMS.online provides a cloud-based platform to facilitate the implementation of ISO 27001. It makes managing your information security risk processes effortless and efficient.

ISMS.online offers a suite of tools to streamline the documentation, implementation, upkeep, and improvement of your information security management system (ISMS) and ensure compliance with ISO 27001:2022.

Contact us now to book a demonstration.