ISO 27002:2022 introduces several new information security controls including A5.30 – ICT readiness for business continuity
This blog takes a brief look at what is required.
ICT readiness for business continuity in ISO 27002:2022
The new control id 5.30 – ICT readiness for business continuity has been added to ISO/IEC 27002:2022 to ensure the availability of the organization’s information and other associated assets during disruption.
The control is regarding ICT readiness which should be planned, implemented, maintained, and tested based on business continuity objectives and ICT continuity requirements.
The new control gives guidance in ICT readiness for business continuity is an important component in business continuity management and information security management to ensure that the organization’s objectives can continue to be met during disruption.
The ICT continuity requirements are the outcome of the business impact analysis (BIA). The BIA process should use impact types and criteria to assess the impacts over time resulting from the disruption of business activities that deliver products and services.
The BIA involving ICT services can be expanded to define performance and capacity requirements of ICT systems and recovery point objectives (RPO) of information required to support activities during disruption.
How to Evidence A5.30 of ISO 27002:2022
Organisations can evidence control A5.30 in several ways, including:
- an adequate organisational structure is in place to prepare for, mitigate and respond to a disruption supported by personnel with the necessary responsibility, authority, and competence.
- ICT continuity plans, including response and recovery procedures detailing how the organization is planning to manage an ICT service disruption, are:
1) regularly evaluated through exercises and tests
2) approved by management
- ICT continuity plans include the following ICT continuity information:
- performance and capacity specifications to meet the business continuity requirements and objectives as specified in the BIA
- RTO of each prioritised ICT service and the procedures for restoring those components
- RPO of the prioritised ICT resources defined as information and the procedures for restoring the information.
Implement A5.30 – ICT readiness for business continuity
If you need assistance with control A5.30, Assent’s ISO 27002 Consultants can help.
Contact us to discuss how we can help with this ISO 27002 Control and the ISO 27001 Information Security Management System in general.
