Information security during disruption

Plain-language summary

Planning how information security is kept at an appropriate level when the business is disrupted — a power outage, flood, pandemic or cyber attack — so that continuity workarounds do not quietly switch off the controls that protect information.

What the clause is really asking

During a disruption people improvise: data goes onto personal laptops, shared passwords appear on whiteboards, a temporary supplier gets admin access. This control asks you to work out in advance how information security will be kept at the right level while the business is disrupted. In practice the business continuity and recovery plans include the security requirements: which controls must keep working in a crisis, which can be relaxed and on whose authority, what compensating controls apply when the normal ones are unavailable, and how you return to normal security afterwards. Where controls cannot be maintained, the risk should be assessed and accepted at the right level. The common misunderstanding is that business continuity is a separate system owned by someone else. The ISMS does not need to duplicate the continuity plan, but it must make sure that plan contains security. In South Africa, load-shedding and extended power outages are the familiar test: what happens to access control, CCTV, alarms and logging when the power goes, and to backups when the generator fails?

What auditors look for

Auditors ask for the business continuity or crisis plans and look for the security content: which controls stay on, who may authorise exceptions, how alternative sites and remote working are secured. They pick a past disruption — an outage, a system failure, a sudden move to remote work — and ask what happened to security during it. They check whether continuity exercises included a security scenario and whether exceptions granted in a crisis were reversed. The hard question: during your last major disruption, which controls were switched off, who decided, and when were they restored?

Typical evidence

Business continuity and disaster recovery plans with information security requirements; list of controls to maintain during disruption and their compensating controls; authority for emergency exceptions; risk assessments for disruption scenarios; exercise and test reports covering security; records of security exceptions during real disruptions and their reversal; power resilience arrangements for security systems.

How to comply — recommendations

Take your existing continuity plans and add a security section to each: controls that must keep running (identity, backups, logging, physical access), emergency workarounds that are allowed, who approves them, the compensating controls, and the check that removes them afterwards. Confirm that alternative sites and emergency remote access are at least as secure as normal operations, including multi-factor authentication. Check power resilience for security systems such as access control, alarms, CCTV and network equipment. Include one security scenario, such as ransomware during an outage, in the annual continuity exercise. After any real disruption, review what was relaxed and restore it.

Common nonconformities

Business continuity plans with no information security content; no defined authority for relaxing controls during a crisis; emergency access or workarounds never removed afterwards; alternative sites or remote access less secure than normal operations; security systems failing during power outages; continuity exercises never testing security; no risk assessment for disruption scenarios.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $29Incident & Breach Response KitWhen something happens the questions arrive faster than the facts: is it an incident, how bad, is it a POPIA breach, who must be told and by when, what do we write, what do we keep. This kit answers them in order.
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.