ISO 27001 Annex A 5.29 Maintain information security during disruptions
What it says
The organization shall plan how to maintain information security at an appropriate level during disruption.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPlan to keep information secure even when normal operations are interrupted.
Imagine your business hits a snag, like a power outage or a cyber attack. This control is about making sure your important information stays safe and sound during such disruptions. If you don't plan for these hiccups, you could lose data or leak confidential information, which can harm your reputation and cost you money.
Free. Save your status, tasks and notes.
Why it matters
During disruptions, weakened controls and ad‑hoc workarounds can expose data, enable unauthorised access, and cause compliance and reputational damage.
How to implement
The IT manager should develop a business continuity plan that includes information security measures.
Identify critical data and systems, and decide how you'll protect them if there's a disruption. Use ISO 27002:2022 as a guide, and consider regulations like the Australian Privacy Act for requirements on protecting personal data.
The HR department should train all staff on what to do during disruptions to ensure they understand how to keep information secure.
Conduct training sessions that focus on quick responses to threats and practical steps to take, ensuring compliance with your plan.
The Board should review and approve the business continuity plan, ensuring it aligns with organisational priorities.
Regularly evaluate the plan's effectiveness during simulated disruptions and update it based on these tests.
The IT team should set up compensating security controls for systems that are vulnerable during outages or cyber incidents.
This might involve backup systems or isolation techniques to ensure data remains intact and secure throughout any problems.
The COO should ensure regular testing of continuity procedures to confirm that they work as expected in real-life scenarios.
Use lessons learned from these tests to refine and improve procedures, maintaining an up-to-date status in alignment with ISO 27001 and ISO 22301 guidelines.
Keep it running
Regularly test disruption scenarios (DR, outages) to ensure access controls, backups, logging, and secure comms remain effective; brief staff on secure workarounds.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the business continuity plan, including information security strategies.
Look at
Check if the plan includes measures for maintaining data confidentiality, integrity, and availability during disruptions.
Good evidence
The plan is comprehensive, covering all critical data and has been approved by senior management with regular updates and reviews documented.
- Check 2 of 5What an auditor asks for
Ask for
Ask for records of staff training sessions related to information security during disruptions.
Look at
Verify attendance lists and session content to ensure it includes clear instructions for disruption scenarios.
Good evidence
Training records show that all relevant staff have attended sessions specific to their role and the information is up-to-date.
- Check 3 of 5What an auditor asks for
Ask for
Request evidence of testing the business continuity plan.
Look at
Look for documented results from recent drills or simulations.
Good evidence
Documentation shows regular, realistic tests of continuity measures with action points addressed in follow-up reviews.
- Check 4 of 5What an auditor asks for
Ask for
Ask for logs or reports showing compensating controls during recent disruptions.
Look at
Check for the implementation of temporary measures and their effectiveness in maintaining security levels.
Good evidence
Reports indicate clear usage of backup systems or other controls that effectively maintained data security during actual or simulated disruptions.
- Check 5 of 5What an auditor asks for
Ask for
Request the minutes from Board meetings where the continuity plan was reviewed.
Look at
Look for evidence of discussions and decisions around updates or changes to the plan.
Good evidence
Minutes reflect a proactive approach by the Board to review, discuss, and authorise updates to the business continuity plan based on current risks.
Mappings
Closest match in ASD Essential Eight: E8-MF-ML2.12, Cyber security incident response plan enacted after incident identification, which partially overlaps with this control.
ASD Essential Eight: 1 mapping
- E8-MF-ML2.12Cyber security incident response plan enacted after incident identificationPartially overlaps
This control partially overlaps E8-MF-ML2.12.
Annex A 5.29 requires planning to maintain information security during disruptions. E8-MF-ML2.12 overlaps by requiring that, once a cyber security incident is identified, the incident response plan is enacted, which is an operational step that maintains security during a disruptive incident. E8-MF-ML2.12 is narrower because it triggers only after incident identification, while Annex A 5.29 also requires pre-planned arrangements for maintaining security across broader disruption types and timeframes.
ASD Information Security Manual: 5 mappings
This control partially overlaps ISM-0043.
Annex A 5.29 requires planning to maintain information security at an appropriate level during disruption. ISM-0043 overlaps by mandating system cyber security incident response plans, including contingency measures, which are a common type of disruption planning to preserve security during and after incidents. The overlap is partial because Annex A 5.29 also covers non-incident disruptions (e.g. outages, disasters) and broader continuity of security controls beyond incident response procedures.
This control partially overlaps ISM-0576.
Annex A 5.29 requires the organisation to plan for maintaining information security during disruptions. ISM-0576 relates by requiring an incident management policy and incident response plan, which supports maintaining security when disruptions are caused by cyber incidents. The primary control is broader because it covers disruption scenarios beyond incidents and expects planning for maintaining security levels across operations, not just incident handling governance and playbooks.
This control partially overlaps ISM-0734.
Annex A 5.29 requires the organisation to plan how to maintain information security at an appropriate level during disruptions. ISM-0734 relates by requiring the CISO to contribute to business continuity and disaster recovery planning so business-critical services remain supported during a disaster, which is a key mechanism for sustaining security controls when operations are disrupted. However, Annex A 5.29 is broader in that it is not limited to the CISO role or to DR/BCP artefacts, and it focuses on maintaining information security (not just service continuity).
This control depends on ISM-0570.
ISM-0570 requires that backup or alternative email gateways are maintained to the same standard as the primary email gateway to avoid security gaps when switching gateways during outages or maintenance. Annex A 5.29 requires organisations to plan how to maintain information security at an appropriate level during disruption, and maintaining hardened, up-to-date alternate gateways is a specific way to preserve email security controls during a disruption scenario. Annex A 5.29 is broader and planning-focused across all disruption types and services, while ISM-0570 is a targeted operational requirement that supports that planning by addressing a common disruption dependency (email gateway failover).
This control depends on ISM-2006.
Annex A 5.29 requires the organisation to plan for maintaining information security at an appropriate level during disruptions. ISM-2006 supports this by ensuring executive leadership plans for major cyber security incidents and participates in exercises, improving governance, decision making and readiness during disruptive events. ISM-2006 is focused on board/executive preparedness for cyber incidents, while Annex A 5.29 covers the full set of disruption scenarios and the operational arrangements needed to sustain security controls.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.