ISO 27001 A.5.29: Maintain Security During Disruption

What A.5.29 requires in practice

Control A.5.29 asks the organisation to plan how it will keep information security at a suitable level while operations are disrupted. A disruption may be a fire, an outage, a pandemic or a supplier failure. In such moments normal controls are often relaxed or bypassed, which is exactly when information is most exposed.

In practice the control asks you to think through which security protections must continue, which can be adapted and what temporary arrangements are acceptable. It links to business continuity planning without replacing it. For example, a fallback site or remote working arrangement should still protect access, data and communications. The standard does not specify a level; appropriate is judged against your risks and obligations. Documenting the security expectations inside continuity plans is one practical way to show the thinking.

Examine the fallback method as a new operating condition

Take a prioritised activity and describe how it would operate without its normal resources. Identify what information is needed, where it would move and who would handle it. A fallback that relies on personal email, printed records or shared accommodation changes the protection problem even if the business activity remains the same.

Decide which security requirements remain essential and how they can be met. Where a normal control cannot operate, consider a suitable alternative or compensating measure. Assess the remaining risk and establish who may authorise the temporary arrangement. “Business continuity” should not become an undefined exemption from all security rules.

Include the limits of the workaround. A manual process may be sustainable for a short period but become unreliable as volume increases. An alternative location may have limited secure storage. Knowing these limits helps management decide when to reduce activity or move to another option.

Preserve integrity during manual or improvised work

Temporary processes can lose the checks built into ordinary systems. Duplicate records, uncertain versions and unclear approvals can create consequential errors. Define how information is identified, authorised and reconciled when the normal service returns.

Consider confidentiality at the same time. Staff working in an unfamiliar environment may lack private rooms, secure printing or approved disposal. Connect the fallback with remote-working arrangements and suitable physical safeguards. The organisation should prepare usable alternatives before staff are forced to invent them.

Why security during disruption matters to the business

Disruption creates opportunity for attackers and for accurate mistakes. Staff improvise, shortcuts appear and emergency access is granted and forgotten. A business that restores service but loses control of its information may find the secondary harm larger than the original outage. Planning security into the response lets the organisation keep serving customers without abandoning protections that clients and regulators expect. It also supports confidence in continuity plans, because they cover protection of information as well as restoration of service. Auditors often ask how the organisation would behave on its worst day.

How to implement A.5.29

Build on existing continuity work rather than creating a separate exercise. One workable route is below. Disruption planning is easiest when attached to continuity work already under way. Ask the people who maintain those plans which security assumptions they contain, and which are left silent. Pay particular attention to temporary measures, because emergency fixes tend to outlive the emergency. Keep exception approvals short and recorded, so you can restore normal controls as soon as conditions allow, and learn from each real disruption.

1. Identify the critical processes and the information they rely on.
2. Decide which security controls must keep working in a disruption.
3. Agree which controls may be adapted, and what compensating measures apply.
4. Plan security for temporary arrangements such as alternate sites or remote access.
5. Define who may approve emergency exceptions and how they are recorded and withdrawn.
6. Include security steps in continuity and recovery plans.
7. Test with a scenario and fix gaps.

Illustrative BPO example: customer work moves to a fallback site

Illustrative construction example: paper approvals during an outage

A hypothetical contractor temporarily uses paper records when its project approval platform is unavailable. Different teams begin marking copies independently, creating uncertainty about which decisions are authorised and which drawing version applies.

The fallback arrangement assigns controlled identifiers, an approval route and a secure collection point. On restoration, an authorised team reconciles the records and resolves conflicts before treating the electronic system as complete. The approach protects integrity through disruption and return, rather than simply scanning every paper into a folder.

Make temporary access and communication deliberate

Disruption can increase requests for emergency permissions and alternative communication channels. Define the authority, intended duration and review point for these changes. Retain enough information to reverse them safely when normal operations resume.

Incident and continuity teams should coordinate. A disruption caused by a security incident may make some information or systems untrustworthy, so the first available recovery option may not be suitable. Link decisions with incident response where appropriate.

Test both the fallback and the return

Exercises should ask whether the business can perform the priority activity with acceptable security, not merely whether a substitute system starts. Use representative information and realistic role boundaries. Check how records are stored, who can see them and how decisions are authorised.

Returning to normal operation needs attention too. Remove temporary permissions, reconcile information, account for physical copies and confirm that normal protections function again. A workaround left permanently in place may become an unreviewed service with weaker controls than the original arrangement.

Evidence and common mistakes