Contact with authorities

Plain-language summary

Knowing in advance which authorities you may need to notify or call on — regulators, law enforcement, emergency services — keeping their details and reporting channels current, and deciding who contacts them, when and how.

What the clause is really asking

Mid-incident is no time to find out who the regulator is and what they need. This control asks you to know which authorities matter to you and keep the lines to them open: identify them, keep their contact details and reporting channels current, and decide who contacts them, when and how. In South Africa the list usually starts with the Information Regulator, because POPIA section 22 requires notification of a security compromise involving personal information as soon as reasonably possible after discovery, and those notifications go through the Regulator's eServices portal. Add SAPS for cybercrime, fraud and theft — and check whether the Cybercrimes Act's reporting duties apply to your sector — and your sector regulator: the FSCA or the Prudential Authority for financial institutions under Joint Standard 2 of 2024, whose suppliers are often bound into those notification timelines by contract. Emergency services and utilities belong on the list for physical incidents. The common misunderstanding is that a phone list is enough; the control is about knowing your obligations and having access ready.

What auditors look for

Auditors ask for the list of authorities and check it is current — they may look up a number or two. They ask who is authorised to contact each authority and whether that person has what they need, such as a working eServices portal login for the Information Regulator. They trace a past incident or a tabletop exercise to see whether a notification decision was made and recorded, including a decision not to notify. For suppliers to financial-sector clients they ask how contractual incident-notification timelines are met. They check the contacts are linked from the incident response plan. The hard question: if personal information leaked this afternoon, who would notify the Regulator, and how?

Typical evidence

Register of relevant authorities with contact details, reporting channels and triggers for contact; named persons authorised to contact each; confirmed Information Regulator eServices portal access; incident response plan linked to the register; records of past notifications or decisions not to notify; tabletop exercise records; contractual notification obligations to regulated clients; register review dates.

How to comply — recommendations

Build a one-page authorities register: the Information Regulator, SAPS (local station and the cybercrime reporting route), your sector regulator, emergency services, municipal utilities and any client-imposed notification duties. For each, record when you must or would make contact, the deadline, the channel and the authorised person. Set up the Information Officer's access to the Information Regulator's eServices portal now and confirm the login works. Link the register to the incident response plan and add a notification decision step with the reason recorded. Run a tabletop exercise once a year that ends in a mock notification. Check every contact detail at least annually and after any regulatory change.

Common nonconformities

No list of relevant authorities, or one with outdated contacts; nobody authorised to notify the Information Regulator; no working access to the Regulator's eServices portal; incident plan silent on regulatory notification; past personal information breaches with no notification decision recorded; contractual notification duties to regulated clients unknown to the incident team; register never reviewed.

Resources for this clause

• ArticlePOPIA section 19 and ISO 27001: how the standard evidences the law — and why a certificate is not compliance
• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $29Incident & Breach Response KitWhen something happens the questions arrive faster than the facts: is it an incident, how bad, is it a POPIA breach, who must be told and by when, what do we write, what do we keep. This kit answers them in order.
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.