A.5.5
Contact with authorities
Organizational controlsCheckpoints 5Evidence 5Cases 5
Control objective
This control ensures that the organization establishes and maintains contact arrangements with relevant authorities for information security, such as regulators/supervisory bodies, the data protection authority, national incident response bodies, law enforcement, and emergency services (fire/disaster). In normal times these contacts are needed to track changes in laws/regulations and confirm compliance guidance; in a crisis they are needed to report incidents/disasters promptly and obtain assistance. Deciding in advance who to contact, in what situations, and by what means enables a fast response with no reporting delay or missed statutory deadline when an incident occurs.
Key checkpoints
- Are the relevant authorities that may need to be contacted (regulators/supervisory bodies, the data protection authority, incident response bodies, law enforcement, emergency services) identified and listed for information security and privacy?
- For each authority, are the contact person, contact method, and triggering situations (reportable incident types, statutory reporting deadlines) defined in advance?
- Is the procedure for reporting to authorities in line with the legally required scope/deadline/method for incidents and personal data breaches reflected in the incident response scheme?
- Are authority contact details and responsible-person information kept current, and managed so that contact is still possible when a person is unavailable?
- Are records of contact with authorities (reports, requests for assistance, guidance received) kept and used for subsequent improvement?
Implementation guidance
- Identify the authorities that need to be contacted based on the regulations/laws and incident types applicable to the organization, and maintain a list with the body name, jurisdiction, contact details, and point of contact.
- Define contact criteria and procedures per situation (routine enquiry, incident report, personal data breach notification, disaster/emergency) and state the reporting scope/deadline/method in the incident response plan (such as A.5.24).
- Evaluate statutory reporting triggers and deadlines alongside incident classification, independently of the internal severity rating. A low internal rating or an ongoing investigation must not cause an applicable report to be missed.
- Designate a contact person and a backup, and maintain an emergency contact scheme and details for incidents that need 24/365 response.
- Predefine the information to share, secure transmission channels, contacts, and delegated authority. Internal approvals or an unavailable central contact must not delay statutory deadlines or requests for emergency assistance.
- Regularly verify/update contact details and responsible persons, and record actual contact (reports/assistance) history to feed exercises and procedure improvement.
Evidence
- Contact list/register of relevant authorities (regulators/supervisory bodies, the data protection authority, incident response bodies, law enforcement, emergency services)
- Incident response procedure or emergency contact scheme stating the reporting scope/deadline/method per situation
- Records of reporting to authorities when a personal data breach/security incident occurs (report forms, acknowledgement of receipt)
- Designation document for authority contact persons and their backups
- Periodic verification/update history of contact details, and contact history such as assistance requests/guidance received
Nonconformity examples
- An incident or personal data breach occurred, but the bodies to report to and the statutory deadlines were not defined in advance, so reporting was delayed or omitted.
- The authority contact list is outdated and does not reflect changes of person/contact details, so contact cannot be made when needed.
- The incident response plan does not include a procedure for reporting to authorities, so at incident time staff do not know whom to report to or how.
- Only a single contact person is designated, so emergency contact and reporting are impossible during their absence or leave.
- Reporting is made past the statutory deadline (for example, the breach notification/reporting deadline), or the fact and history of reporting are not recorded.