Key takeaways
- Keep security at the right level during disruptions and crises.
- Disruptions such as outages, cyberattacks or disasters must not switch off security.
- Start here: identify which security controls must keep running during disruption.
Purpose
Keep security at the right level during disruptions and crises.
Requirement
Requirement summaryThe organization shall plan how to maintain information security at an appropriate level during disruption.
Why it matters
Disruptions such as outages, cyberattacks or disasters must not switch off security. Controls need to keep working in a crisis.
How to implement
- Identify which security controls must keep running during disruption.
- Plan how they will operate in degraded mode.
- Include security in business continuity plans and tests.
- Review after each test or real event.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.29. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your business continuity plan, showing how security stays in place during a disruption.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.29 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Test results that include security checks.
- Records from any real disruption showing security was maintained, including emergency access.
Things you should be able to show or explain
- Be able to explain how security works when normal systems are down.
How much to show: Your last continuity test.
Common mistakes
- Continuity plan ignores security.
- Emergency access not reviewed afterwards.
- Disabling security controls to restore service faster.
- Continuity plans with no security section.
- Tip: Make sure emergency workarounds don't bypass key controls.
Policies & documents to have
- Business Continuity and Disaster Recovery Plan
FAQ
Is A.5.29 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.29?
Be ready to explain how the control works in your organisation and to provide things like: Your business continuity plan, showing how security stays in place during a disruption…