Purpose of Control 5.30
Control 5.30 acknowledges the important role played by ICT platforms and services in maintaining business continuity, following disruption or a critical event.
Control 5.30 outlines how ICT services interact with various key metrics and supporting controls, including an organisation’s recovery time objective (RTO) and the overall business impact analysis (BIA).
The end goal is to ensure that information integrity and availability is maintained before, during and after a period of business disruption.
Attributes Table of Control 5.30
5.30 is a corrective control that maintains risk by creating ICT continuity plans which contribute towards the organisation’s overall level of operational resilience.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Corrective | #Availability | #Respond | #Continuity | #Resilience |
Get an 81% headstart
We've done the hard work for you, giving you an 81% Headstart from the moment you log on.
All you have to do is fill in the blanks.
General Guidance of Control 5.30
Processes and procedures created through Control 5.30 should be drafted following a thorough BIA, that considers how an organisation needs to react when experiencing operational disruption.
A BIA should make use of differing impact types and organisation-specific variables to gauge how business continuity will be affected, should any or all products and services be rendered unavailable or inoperable, due to any level of disruption.
Organisations should use two key variables to formulate an agreed-upon RTO, that sets clear goals for resumption of normal operations:
a) the magnitude of the disruption
b) the type of disruption experienced
Within their BIA, organisations should be able to specify precisely what ICT services and functions are required to achieve recovery, including individual performance and capacity requirements.
Organisations should undergo a risk assessment that evaluates their ICT systems and forms the basis of an ICT continuity strategy (or strategies) that bolsters recovery prior to, during and following a period of disruption.
Once a strategy has been agreed, specific processes and plans should be put in place to ensure that ICT services are resilient and adequate enough to contribute towards recovery of critical processes and systems, before, during and after disruption.
Within the scope of ICT continuity plans, Control 5.30 outlines three main guidance points:
- ICT incidents often require quick decisions to be made relating to information security by senior members of staff, in order to expedite recovery.
- ICT continuity plans should be given a great deal of attention, including regular testing and evaluations, and approval by senior management.
- ICT continuity plans should contain the following information:
Organisations need to maintain a robust chain of command that includes competent individuals with the ability to make authoritative decisions on technical matters related to business continuity and RTO adherence.
Organisational structures need to be up to date and widely communicated, to facilitate adequate communication and speed up recovery times.
Organisations should conduct test runs to gauge their effectiveness, and measure key metrics such as response and resolution times.
a) performance and capacity requirements of any systems or processes used in recovery efforts
b) a clear RTO for each ICT service in question, and how the organisation aims to restore them
c) a recovery point objective (RPO) is designated for each ICT resource, and procedures are created that ensure information is able to be restored.
Compliance doesn't have to be complicated.
We've done the hard work for you, giving you an 81% Headstart from the moment you log on.
All you have to do is fill in the blanks.
Changes From ISO 27002:2013
ISO 27002:2022, control 5.30 is a new control with no precedence in ISO 27002:2013.
New ISO 27002 Controls
New Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | New | Threat intelligence |
| 5.23 | New | Information security for use of cloud services |
| 5.30 | New | ICT readiness for business continuity |
| 7.4 | New | Physical security monitoring |
| 8.9 | New | Configuration management |
| 8.10 | New | Information deletion |
| 8.11 | New | Data masking |
| 8.12 | New | Data leakage prevention |
| 8.16 | New | Monitoring activities |
| 8.23 | New | Web filtering |
| 8.28 | New | Secure coding |
Organisational Controls
People Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
Physical Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | New | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
Technological Controls
How ISMS.online Helps
ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process, from defining the scope of your ISMS through risk identification and control implementation.
Our platform is intuitive and easy-to-use. It’s not just for highly technical people; it’s for everyone in your organisation. We encourage you to involve staff at all levels of your business in the process of building your ISMS, because that helps you to build a truly sustainable system.
Get in touch today to book a demo.
Jump to topic
