ISO 27002:2022, Control 5.30 – ICT Readiness for Business Continuity

General Guidance of Control 5.30

Processes and procedures created through Control 5.30 should be drafted following a thorough BIA, that considers how an organisation needs to react when experiencing operational disruption.

A BIA should make use of differing impact types and organisation-specific variables to gauge how business continuity will be affected, should any or all products and services be rendered unavailable or inoperable, due to any level of disruption.

Organisations should use two key variables to formulate an agreed-upon RTO, that sets clear goals for resumption of normal operations:

a) the magnitude of the disruption

b) the type of disruption experienced

Within their BIA, organisations should be able to specify precisely what ICT services and functions are required to achieve recovery, including individual performance and capacity requirements.

Organisations should undergo a risk assessment that evaluates their ICT systems and forms the basis of an ICT continuity strategy (or strategies) that bolsters recovery prior to, during and following a period of disruption.

Once a strategy has been agreed, specific processes and plans should be put in place to ensure that ICT services are resilient and adequate enough to contribute towards recovery of critical processes and systems, before, during and after disruption.

Within the scope of ICT continuity plans, Control 5.30 outlines three main guidance points:

1. ICT incidents often require quick decisions to be made relating to information security by senior members of staff, in order to expedite recovery.
   
   Organisations need to maintain a robust chain of command that includes competent individuals with the ability to make authoritative decisions on technical matters related to business continuity and RTO adherence.
   
   Organisational structures need to be up to date and widely communicated, to facilitate adequate communication and speed up recovery times.
2. ICT continuity plans should be given a great deal of attention, including regular testing and evaluations, and approval by senior management.
   
   Organisations should conduct test runs to gauge their effectiveness, and measure key metrics such as response and resolution times.
3. ICT continuity plans should contain the following information:
   
   a) performance and capacity requirements of any systems or processes used in recovery efforts
   
   b) a clear RTO for each ICT service in question, and how the organisation aims to restore them
   
   c) a recovery point objective (RPO) is designated for each ICT resource, and procedures are created that ensure information is able to be restored.

Changes From ISO 27002:2013

ISO 27002:2022, control 5.30 is a new control with no precedence in ISO 27002:2013.

How ISMS.online Helps

ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process, from defining the scope of your ISMS through risk identification and control implementation.

Our platform is intuitive and easy-to-use. It’s not just for highly technical people; it’s for everyone in your organisation. We encourage you to involve staff at all levels of your business in the process of building your ISMS, because that helps you to build a truly sustainable system.

Get in touch today to book a demo.