ISO 27001 Annex A 5.5 Establish and maintain contact with authorities
What it says
The organization shall establish and maintain contact with relevant authorities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure you can quickly contact authorities like police or regulators for security issues.
This control is about making sure your organisation can quickly get in touch with the right authorities, like the police or regulators, when a security issue happens. This is important because delays in contacting authorities can make security problems worse and harder to fix.
Free. Save your status, tasks and notes.
Why it matters
Delayed or absent contact with authorities can escalate incidents, causing reputational damage and regulatory or legal consequences.
How to implement
Senior Management should designate a contact person within the organisation who will be responsible for communication with authorities.
This person should be well-versed in the organisation's security policies and have the authority to make necessary decisions.
The IT manager should establish a contact list of relevant authorities, such as local police, data protection offices, and regulatory bodies.
This list should include names, phone numbers, and email addresses and should be regularly updated.
The Risk Officer should develop a procedure for when and how authorities should be contacted during security incidents.
This procedure should be simple, clear, and included in the organisation's incident response plan.
HR should ensure that training is provided to all employees about the importance of timely reporting of security incidents and who to notify in such events, according to the procedure established.
Compliance Officers should regularly review current and upcoming regulations related to information security, to ensure that the organisation's policies and procedures remain in compliance and communicate any changes to relevant personnel.
Keep it running
Regularly test and update authority contact details, after-hours numbers, and liaison roles so escalation to relevant regulators or police works in an emergency.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request to see the list of relevant authority contacts.
Look at
Check that the list includes accurate contact information for all necessary authorities.
Good evidence
The contact list is comprehensive, up-to-date, and accessible to those who need it.
- Check 2 of 5What an auditor asks for
Ask for
Ask to review the procedure for contacting authorities during security incidents.
Look at
Inspect the clarity and completeness of the procedure and its alignment with the organisation's incident response plan.
Good evidence
The procedure is clear, documented, and staff are aware of it.
- Check 3 of 5What an auditor asks for
Ask for
Ask for records of any communications or incidents that required contact with authorities.
Look at
Ensure records show timely and appropriate contact with the correct authorities.
Good evidence
Records are well-documented and demonstrate a timely response to incidents.
- Check 4 of 5What an auditor asks for
Ask for
Inquire about employee training materials regarding reporting procedures for security issues.
Look at
Examine the content to ensure it includes guidance on who to contact and how to report incidents.
Good evidence
Training materials are comprehensive and routinely delivered to all employees.
- Check 5 of 5What an auditor asks for
Ask for
Request any meeting notes or communications with regulatory bodies regarding compliance and security expectations.
Look at
Verify these documents show ongoing conversations and compliance with regulatory requirements.
Good evidence
Regular communication is maintained with authorities, demonstrating proactive compliance management.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.17, Report cyber security incidents to ASD promptly, which this control covers in full and more.
ASD Essential Eight: 3 mappings
This control is broader than E8-AH-ML2.17.
E8-AH-ML2.17 requires prompt reporting of cyber security incidents to ASD. Annex A 5.5 supports this by requiring the organisation to establish and maintain contact with relevant authorities, which facilitates rapid, accurate notification pathways when an incident occurs. Annex A 5.5 is broader relationship management, while E8-AH-ML2.17 defines the specific reporting action and timeliness requirement.
This control is broader than E8-MF-ML2.11.
E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. Annex A 5.5 supports this by requiring the organisation to establish and maintain contact with relevant authorities, which would include having the right channels and points of contact available for ASD reporting. Annex A 5.5 does not mandate incident reporting or timeliness, but it enables faster, more reliable execution of E8-MF-ML2.11.
This control is broader than E8-RA-ML2.12.
E8-RA-ML2.12 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. Annex A 5.5 supports this by requiring the organisation to establish and maintain contact with relevant authorities, which includes setting up the channels and points of contact needed to notify ASD quickly. Annex A 5.5 is broader and preparatory, while E8-RA-ML2.12 is the specific operational requirement to report incidents to ASD.
ASD Information Security Manual: 5 mappings
This control is broader than ISM-0140.
Annex A 5.5 requires the organisation to establish and maintain contact with relevant authorities to support rapid coordination during security issues. ISM-0140 directly connects by requiring cyber security incidents to be reported to ASD as soon as possible, which depends on having an established ASD reporting mechanism and contact pathway. Annex A 5.5 is broader because it is not limited to ASD nor to incidents, and includes maintaining contact with other authorities relevant to the organisation.
This control partially overlaps ISM-0043.
Annex A 5.5 requires the organisation to establish and maintain contact with relevant authorities so engagement can occur quickly when needed. ISM-0043 supports this by requiring incident response plans to define how to report incidents externally to relevant authorities and criteria for involving law enforcement, ASD or other authorities, which helps structure and exercise those contacts. ISM-0043 is broader in incident-management detail, while Annex A 5.5 is specifically about maintaining the authority contact relationships/points of contact.
This control supports ISM-0249.
ISM-0249 requires system owners deploying SECRET or TOP SECRET systems on mobile platforms or as a deployable capability to contact ASD for an emanation security threat assessment. Annex A 5.5 requires the organisation to establish and maintain contact with relevant authorities, which supports having the channels, relationships and procedures needed to engage ASD when an emanation assessment is required. ISM-0249 is a specific, classification- and deployment-context trigger, while Annex A 5.5 is a standing governance expectation that does not mandate emanation assessments.
This control supports ISM-0576.
ISM-0576 requires an incident management policy and incident response plan that are implemented and maintained, which typically include external notification and coordination procedures during incidents. Annex A 5.5 requires the organisation to establish and maintain contact with relevant authorities, enabling the practical execution of the external liaison steps that the ISM-0576 plan would call for (e.g. knowing who to contact and how). Annex A 5.5 does not require an incident response plan or incident governance, but it supports ISM-0576 by making authority engagement feasible when the plan is enacted.
This control supports ISM-1137.
ISM-1137 requires system owners deploying SECRET or TOP SECRET systems in fixed facilities to contact ASD for an emanation security threat assessment. Annex A 5.5 requires the organisation to establish and maintain contact with relevant authorities, which includes engaging with ASD when assessments are needed. ISM-1137 is a specific, classified-system requirement related to emanation security, whereas Annex A 5.5 covers broader organisational relationships.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.
Draft your ISO 27001 documentation