What evidence do auditors commonly ask for on 5.5 Contact with authorities?

A register of relevant authorities (law enforcement, regulators, supervisory bodies, utilities, emergency services) with current contact details; A procedure stating when each authority is contacted, by whom, and the reporting timelines for incidents; Records of incident notifications made to authorities and their timing; Records of engagement used to track current and upcoming regulatory expectations; Evidence the contact register is reviewed and kept up to date; Links between the contact procedure and the incident response and continuity plans.

What is the most common gap auditors find on 5.5?

Contact details are stale or held only by one individual

ISO/IEC 27002:2022 · Organizational controls

`5.5` Contact with authorities

The organization is to set up and keep up working contact with the authorities that are relevant to it. Purpose: allow information security matters to pass properly between the organization and the legal, regulatory and supervisory bodies concerned. Guidance: the organization decides in which circumstances and by whom bodies such as law enforcement, regulators and supervisory authorities are contacted, and how confirmed information security incidents are reported to them promptly. These relationships are also a way to learn what the authorities expect now and plan to expect, for example forthcoming security regulations. Other information: an organization being attacked may ask authorities to act against the source; such contacts support incident management (5.24 to 5.28) and continuity (5.29 and 5.30), help anticipate legal change, and extend to utilities, emergency services, power, telecommunications and water providers and health and safety bodies such as fire services.

Source: ISO/IEC 27002:2022, 5.5. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.

ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.

artefacts

held by a system

at each review

hard

to go live

Policy repository / GRC workspace

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Records of incident notifications made to authorities and their timing · Regulator portal / correspondence

periodic reviewEvidence produced at each review

Records of engagement used to track current and upcoming regulatory expectations · Regulator portal / correspondence

governing documentDocuments that govern the control

A register of relevant authorities (law enforcement, regulators, supervisory bodies, utilities, emergency services) with current contact details · Policy repository / GRC workspace
A procedure stating when each authority is contacted, by whom, and the reporting timelines for incidents · Policy repository / GRC workspace
Evidence the contact register is reviewed and kept up to date · Policy repository / GRC workspace
Links between the contact procedure and the incident response and continuity plans · Policy repository / GRC workspace

First move

Mostly documents and reviews. Pull the 1 system-held artefact from your Regulator portal / correspondence on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.

Common gaps auditors find

Contact details are stale or held only by one individual
No defined decision point or owner for notifying a regulator, so notifications miss statutory deadlines
Utilities and emergency services are omitted from the continuity contact list
Regulatory horizon scanning is not linked to the authority relationships

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

5.4 Management responsibilities · 5.6 Contact with special interest groups