ISO 27001 A.5.5: Keep Authority Contacts Ready for Use

What A.5.5 requires in practice

Annex A control A.5.5 asks the organisation to establish and maintain contact with relevant authorities. The aim is to know, before trouble arrives, whom to approach and how, when an incident, legal matter or emergency involves a public body or regulator.

Establish means the relationships and details exist in advance, not that someone starts searching during a crisis. Maintain means the information stays accurate as people, rules and agencies change. Relevant is decided by the organisation: depending on location and sector it may include law enforcement, data protection and sector regulators, emergency services, and bodies that supply utilities or communications.

The control does not list authorities or set a call-out routine. It also does not say who may contact them; that belongs to incident and legal responsibilities defined elsewhere in the ISMS. The expected outcome is that when a reportable event occurs, the right people can reach the right body quickly and consistently.

Identify why each authority relationship matters

Start with the decisions that could require contact. Depending on the organisation, these may concern an information security event, a regulated service or a disruption affecting facilities. Use competent input to establish which authorities are relevant, rather than compiling an indiscriminate directory of national agencies.

Distinguish different purposes. Seeking clarification about a requirement, reporting a qualifying incident and requesting emergency assistance are not interchangeable. Link the appropriate route to the decision process that uses it. The guide does not prescribe a reporting deadline or legal trigger; those need assessment against the organisation’s actual obligations.

Connect contacts with authorised decisions

Assign who evaluates the need to contact an authority and who communicates on the organisation’s behalf. Provide cover when the usual person is unavailable. An external adviser can assist, but the internal process should still establish who approves statements and ensures that follow-up reaches the responsible team.

For incidents, connect this arrangement with incident planning and preparation. A technical responder may recognise a serious event without having authority to make legal representations. Equally, approval arrangements should not be so vague that everyone waits for someone else while a relevant obligation remains unevaluated.

Keep the route trustworthy and available

Record enough information to use the contact correctly, including its purpose and any required route. Verify details through appropriate official channels and reconsider them when responsibilities or services change. A contact copied from an old email may lead to the wrong office or an obsolete submission method.

Consider access during disruption. If the contact information exists only inside a service affected by the incident, responders may be unable to retrieve it. A protected alternative can be appropriate. Manage confidentiality and updates so that alternative copies remain useful without spreading sensitive internal escalation information unnecessarily.

Why authority contacts matters to the business

When a serious incident happens, time is short and mistakes are costly. Knowing which authority to inform, what each expects and who within the business is allowed to speak to it avoids hesitation and conflicting messages. It also helps the organisation meet any legal duty to notify, which varies by country and sector.

Operating in several countries multiplies this issue, because each location has its own bodies and expectations. Customers often ask whether you can respond properly to a breach affecting their data. Ready contacts, linked to your incident process, show that your response does not depend on one person remembering a phone number.

How to implement A.5.5

Treat this as a short, owned list tied to the incident and legal processes, not a standalone directory. Because the control concerns readiness, favour simple arrangements that stay accurate over elaborate ones that decay.

1. Identify which authorities could matter to your operations, given the countries, sectors, data and services involved.
2. Ask your legal or compliance owner which contacts are required by law and which are simply helpful.
3. Record contact routes, the circumstances for using them and who inside the organisation may make contact.
4. Link the list to your incident procedures so responders see it at the right moment.
5. Name someone to keep it current, and check at intervals that routes still work, particularly after reorganisations or staff changes.
6. Where practical, include the contacts in an incident exercise to test whether the arrangement is usable.
7. Agree how internal teams are told that contact has been made, so incident communications stay consistent.

Evidence an auditor expects for A.5.5

Common nonconformities with A.5.5

Typical findings show contacts that exist only in individual memory or have gone stale. Assessors typically test whether the contacts could actually be used on a difficult day.

• The list is out of date, with names, numbers or bodies that no longer apply.
• Nobody can say who is allowed to contact an authority during an incident.
• The organisation operates in a new country, but no relevant authority there has been identified.
• The list sits in a document that responders would not see during an actual event.
• Different teams keep different lists, and nobody has reconciled them.

Illustrative manufacturing example: a plant disruption

Illustrative software example: customers in several markets

A hypothetical software company receives evidence of possible exposure involving a hosted customer service. The incident team establishes the facts it can support, while designated specialists assess relevant contractual and regulatory responsibilities. The company’s authority-contact arrangement identifies the appropriate internal owner for each affected operating entity.

The team avoids assuming that notifying one authority or one customer resolves every responsibility. It records the basis for decisions and the information communicated through the applicable process. This example concerns governance of communication, not a conclusion about which law applies or when notification is due.

Test the process without creating a false report

A review can ask a deputy to find the correct route for a hypothetical situation and explain who would approve the communication. Use a clearly labelled exercise. Do not send fictional incident reports to real authorities merely to demonstrate that a contact field works; where external participation is appropriate, arrange it explicitly.

Useful evidence may include verified contact information, assigned responsibility, exercise findings and relevant correspondence. No universal directory format is prescribed. Keep legal and contractual requirement management connected to this control so that a changed obligation prompts an appropriate update.

Common failures include storing contacts without their purpose, assuming a group office covers every local operation and leaving the authorised communicator without access to technical facts. Another is treating an authority’s receipt acknowledgement as agreement with the organisation’s assessment. Preserve what the response actually says and route further requests promptly.