Outages happen: ransomware, power failures, floods, cloud region failures or a supplier going out of business. ISO 27001 business continuity controls make sure information stays protected during a disruption, and that critical IT services come back within agreed times.
In the 2013 edition, this was Annex A.17, “Information security aspects of business continuity management”. The 2022 edition rearranged it into two controls and added a new one for ICT readiness. This guide explains them and how to test them.
Free tool: How ready is your organization? Take our ISO 27001 self-assessment: 30 questions on clauses 4–10 and Annex A.
Mapping: A.17 (2013) to ISO 27001:2022
| ISO 27001:2013 | ISO 27001:2022 |
|---|---|
| A.17.1.1 to A.17.1.3 Planning, implementing and verifying continuity | 5.29 Information security during disruption |
| New in 2022 | 5.30 ICT readiness for business continuity |
| A.17.2.1 Availability of information processing facilities | 8.14 Redundancy of information processing facilities |
ISO 27001 is not a full BCM standard
First, a clarification. ISO 27001 focuses on information security. A complete business continuity management system is the subject of ISO 22301. However, the two work well together, and ISO 27001 still expects you to keep security working and IT services available during a crisis.
5.29 Information security during disruption
During a crisis, people take shortcuts. For example, they share files over personal email, disable controls to restore service quickly or give emergency admin rights to many people. This control asks you to plan how security will continue at an appropriate level.
In practice:
- identify which security controls must keep running during an incident;
- prepare alternative secure processes, such as approved emergency communication channels;
- define emergency access procedures, with logging and later review;
- restore normal controls once the crisis ends.
5.30 ICT readiness for business continuity (new)
This new control focuses on IT recovery. Start with a business impact analysis (BIA). For each critical process, agree on:
- RTO (recovery time objective): how quickly the service must be back.
- RPO (recovery point objective): how much data loss is acceptable, measured in time.
Then design IT recovery to meet those targets. For example:
| Service | RTO | RPO | Recovery approach |
|---|---|---|---|
| Customer website | 4 hours | 1 hour | Second cloud region, hourly database snapshots |
| 8 hours | 24 hours | SaaS provider’s resilience, with offline export | |
| Finance system | 24 hours | 4 hours | Restore from immutable backups to standby servers |
Finally, write IT recovery plans with clear steps, owners and contact details.
8.14 Redundancy
Remove single points of failure for critical systems. Typical measures include redundant power, network links, servers and storage, or deployment across multiple availability zones. However, redundancy is not a backup. A deleted or encrypted file replicates instantly, so you still need separate, protected backups (control 8.13).
Testing your plans
Untested plans fail. Therefore, test at increasing levels:
- Walkthrough: read the plan with the team and fix gaps.
- Tabletop exercise: discuss a realistic scenario, such as ransomware.
- Technical test: restore a system from backup and measure the time.
- Full failover: switch a service to the standby site.
Record results, compare them with RTO and RPO, and update the plans.
Ransomware: the most common test case
Today, ransomware is the most likely disruption for most organizations. So make sure your continuity plan covers:
- offline or immutable backups that attackers cannot delete;
- clean rebuild procedures for servers and identity systems;
- decision rights for shutting systems down quickly;
- communication with customers, regulators and law enforcement.
What auditors check
- A BIA with agreed RTO and RPO values.
- IT recovery plans for critical services.
- Test reports, including restore times.
- Evidence that security controls continue during incidents.
- Redundancy for critical infrastructure.
FAQ
Do we need ISO 22301 as well?
Not for ISO 27001 certification. Still, ISO 22301 is useful if you want a complete business continuity management system.
How often should we test?
At least once a year for critical services, and after major changes.
Related guides
- ISO 27001:2022 Annex A: all 93 controls and the 2013 mapping
- Free ISO 27001:2022 readiness checklist
- What is an ISMS? Concept, benefits and the PDCA cycle
Sources
- ISO/IEC 27001:2022, Information security management systems (ISO)
- ISO/IEC 27002:2022, Information security controls (ISO)
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. Doing it yourself? The ISO 27001:2022 Starter Kit (₹1,999) gives you the gap workbook, risk register, Statement of Applicability and 13 policy templates. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
