What evidence do auditors commonly ask for on 5.30 ICT readiness for business continuity?

The business impact analysis with prioritized activities, supporting ICT services and their RTOs, and RPOs for required information; Selected ICT continuity strategies covering before, during and after disruption; Management-approved ICT continuity plans with response and recovery procedures, capacity specifications, RTOs and RPOs; Exercise and test reports showing recovery achieved within RTO and RPO, with remediation of shortfalls; An ICT continuity organization chart with named roles, authority and competence records; Records of plan maintenance after changes to systems or business priorities.

What is the most common gap auditors find on 5.30?

RTOs and RPOs are set by IT without a business impact analysis

ISO/IEC 27002:2022 · Organizational controls

`5.30` ICT readiness for business continuity

ICT readiness is to be planned, put in place, kept current and tested so that it meets the continuity objectives of the business and the requirements for ICT continuity. Purpose: keep the organization's information and associated assets available during disruption. Guidance: ICT readiness is a key part of both continuity and security management, keeping objectives achievable during disruption. ICT continuity requirements come out of the business impact analysis, which uses impact types and criteria to judge how disruption to activities delivering products and services causes harm over time; the size and duration of impact identify prioritized activities, each given a recovery time objective (RTO), and then the resources those activities need, which also get RTOs and include ICT services. The analysis can be extended to set performance and capacity requirements for ICT systems and, for the information needed, recovery point objectives (RPO) for the information needed. From the impact analysis and risk assessment, the organization chooses ICT continuity strategies covering before, during and after disruption, possibly combining solutions, and builds, implements and tests plans that deliver the required ICT availability in the required time. It should ensure a suitable structure of people with the responsibility, authority and competence to get ready for disruption, limit it and react to it; ICT continuity plans with response and recovery procedures that are regularly exercised and tested and approved by management; and plans that state performance and capacity specifications from the impact analysis, the RTO of each prioritized ICT service with restoration procedures, and the RPO of prioritized information with its restoration procedures. Other information: ICT continuity lets the organization respond to and recover from ICT disruption whatever the cause, keep prioritized activities supplied with ICT, and act before disruption and once an incident that could cause one is detected; ISO/IEC 27031, ISO 22301, ISO 22313 and ISO/TS 22317 give more.

Source: ISO/IEC 27002:2022, 5.30. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.

ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.

artefacts

held by a system

at each review

hard

to go live

Document repository

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

The business impact analysis with prioritized activities, supporting ICT services and their RTOs, and RPOs for required information · Document repository
Exercise and test reports showing recovery achieved within RTO and RPO, with remediation of shortfalls · Document repository
An ICT continuity organization chart with named roles, authority and competence records · Identity provider / directory
Records of plan maintenance after changes to systems or business priorities · Policy repository / GRC workspace

governing documentDocuments that govern the control

Selected ICT continuity strategies covering before, during and after disruption · Document repository
Management-approved ICT continuity plans with response and recovery procedures, capacity specifications, RTOs and RPOs · Policy repository / GRC workspace

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

RTOs and RPOs are set by IT without a business impact analysis
Plans are approved but recovery has never been tested end to end
Recovery capacity specifications do not match what prioritized activities actually need
Cloud and third-party ICT services are left out of the continuity plans

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

5.29 Information security during disruption · 5.31 Legal, statutory, regulatory and contractual requirements