5.29 Information security during disruption
Requires the organisation to plan how information security will be maintained at an appropriate level while a disruption is under way.
5
artefacts
0
held by a system
4
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- The assessment of which security controls would be weakened or bypassed during disruption, and the compensating arrangements · Document repository
- Evidence security requirements are part of continuity testing, not only recovery of function · Document repository
- Records of emergency access arrangements, including how they are authorised, logged and withdrawn afterwards · Document repository
- Post exercise or post event review confirming security was actually maintained · Document repository
governing documentDocuments that govern the control
- Continuity plans showing how information security is maintained while the organisation is operating in a degraded or alternative mode · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Continuity plans restore availability while confidentiality and integrity controls are silently suspended
- Emergency access granted during an incident and never withdrawn once normal operation resumes
- Testing covers system recovery only, so no one tests whether logging, monitoring and access control survive the failover
- Alternative sites and manual workarounds operating outside the normal control environment with no assessment
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.28 Collection of evidence · 5.30 ICT readiness for business continuity