A.5.5 Contact with authorities
Keep working relationships with regulators, law enforcement and CERTs before you need them.
12
artefacts
2
held by a system
3
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Updated contact log with timestamps (Excel) · SIEM / log platform
- Change log of authority contacts (Word) · SIEM / log platform
periodic reviewEvidence produced at each review
- Signed memorandum of understanding with data protection authority (PDF) · Vendor register / contract repository
- Recorded minutes of coordination meeting with regulator (PDF) · Policy repository / GRC workspace
- Training attendance record for authority liaison workshop (Excel) · HR system / LMS
governing documentDocuments that govern the control
- Master contact list of regulatory bodies (PDF) · Policy repository / GRC workspace
- Service level agreement with law enforcement for incident handling (PDF) · Vendor register / contract repository
- Contractual clause with CERT for vulnerability disclosure (PDF) · Policy repository / GRC workspace
- Incident response plan section on authority notification (PDF) · Policy repository / GRC workspace
- Email thread demonstrating pre‑incident liaison (EML) · Document repository
- Presentation slides on regulatory communication procedures (PPT) · HR system / LMS
- Quiz results on authority contact policies (PDF) · HR system / LMS
First move
Mostly documents and reviews. Pull the 2 system-held artefacts from your SIEM / log platform on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Contact list not kept current
- No formal agreements with authorities
- Lack of documented coordination during incidents
- Training not covering authority interaction
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA.5.4 Management responsibilities · A.5.6 Contact with special interest groups