ISO 27001 A.5.5: contact with authorities, explained for startups

A.5.5 Contact with authorities

You know how to reach regulators and law enforcement before you need them. What proves it: a list of the authorities you may need to contact, how to reach them, and who makes the call.

A certification auditor samples a current list of authority contacts and when to use each. A file that usually does the job: a contact list in the incident response plan naming the data protection regulator, the police cyber crime unit and any sector regulator.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.5.5 walks you through it in this order.

1. List the authorities that apply: data protection regulators where you have customers, law enforcement and any sector regulator.
2. Record how to reach each and who in the company makes contact.
3. Put the list in your incident plan and check it once a year.

The free ISO 27001 readiness assessment asks one question that evidences it:

• Do you keep current contacts for the authorities and security groups you would need in an incident?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Information Security Policy covers A.5.5. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criterion that cover this ground: CC2.3, external communication.

Organizational controls

A.5.5 is one of the 37 organizational controls in Annex A. How the company runs security: policies, roles, suppliers, incidents, continuity and legal duties. Most of these are written decisions and the records that show you follow them.

Nearby controls in the same theme:

• A.5.2, security roles
• A.5.3, segregation of duties
• A.5.4, what managers must enforce
• A.5.6, security communities
• A.5.7, threat intelligence
• A.5.8, security in projects

Before it: A.5.4, what managers must enforce. After it: A.5.6, security communities. Every control, by theme, is on the Annex A controls page.