ISO 27001 A.5.29: Information security during disruption

Integrate security requirements into your business continuity and disaster recovery planning. The BCP should explicitly address how security controls will be maintained or adapted during each type of disruption. Run a security impact analysis for each major disruption scenario in your continuity plan. For each one, identify which controls are affected, which must be maintained no matter what, which can be temporarily reduced with compensating measures, and what new security risks the disruption itself creates. Document the minimum acceptable security posture for each scenario. Write security procedures for common disruption types. For pandemic or mass remote working: make sure VPN and remote access controls can scale, verify endpoint security on home devices, keep authentication and access control standards in place. For disaster recovery: maintain access controls even in emergency mode, protect backup data, verify recovered systems are securely configured. For cyber incidents: keep security tight on unaffected systems while you deal with the compromised ones. Create a formal process for temporarily modifying security controls during disruptions. Any relaxation needs management authorisation, documentation of the justification and compensating measures, a defined expiry date, and monitoring for abuse. Log every temporary modification. Include security restoration in your recovery process. After a disruption, systematically restore all controls to normal. Verify every temporary modification has been reversed. Run a security review to check for compromises that may have slipped through during the disruption. Test restored controls to confirm they are working properly.