System Guides

To assess compliance with A.5.5 "Contact with Authorities," an information security auditor would need to evaluate how an organization manages and interacts with relevant authorities, such as law enforcement agencies and regulatory bodies, in the context of information security incidents and requirements. Here's a breakdown of the evidence and areas an auditor might review:

1. Incident Reporting Procedures: Review the organization's documented procedures for reporting information security incidents to relevant authorities, including the steps to follow, timelines, and responsible personnel.

2. Legal and Regulatory Requirements: Verify that the organization is aware of and adheres to legal and regulatory requirements related to reporting and communicating information security incidents to authorities.

3. Law Enforcement Liaison: Examine any documented agreements, contacts, or protocols the organization has established with law enforcement agencies for reporting cybercrime or security incidents.

4. Notification Timeline: Assess the organization's ability to promptly notify relevant authorities in case of a significant security incident, as required by applicable laws and regulations.

5. Internal Communication: Review evidence that demonstrates how the organization's internal teams communicate and collaborate when deciding whether and how to involve authorities in an incident.

6. Authorities' Requests: Evaluate procedures or policies related to responding to authorities' requests for information or assistance in investigating security incidents.

7. Documentation: Examine records of any communication, interactions, or correspondence between the organization and authorities regarding information security incidents.

8. Coordination: Assess how the organization coordinates with relevant authorities during incident response efforts to ensure effective collaboration and information sharing.

9. Legal Counsel Involvement: Verify whether the organization involves legal counsel in discussions and decisions regarding interactions with authorities to ensure compliance with legal requirements.

10. Preservation of Evidence: Examine how the organization handles the preservation of evidence related to security incidents to support potential legal proceedings.

11. Incident Reporting Logs: Review logs or documentation of incidents reported to authorities, detailing the nature of the incident, response actions taken, and outcomes.

12. Follow-Up and Resolution: Assess the organization's process for providing authorities with updates on incident resolution, investigation outcomes, and any additional assistance required.

13. Public Communication: Verify whether the organization has established procedures for communicating with the public, customers, or stakeholders about information security incidents that may involve authorities.

14. Training and Awareness: Evaluate whether employees are aware of their responsibilities for contacting authorities and whether they receive training on how to do so effectively.

15. Mock Exercises: Examine evidence of mock exercises or simulations conducted by the organization to test its ability to interact with authorities during incident response scenarios.

By examining these aspects, an auditor can determine whether the organization has well-defined procedures for contacting relevant authorities in the event of information security incidents, complies with legal and regulatory requirements, and maintains effective communication and coordination with external parties during incident response efforts.

Communication with the appropriate authorities must be kept open at all times. Processes should be put in place to define when and with whom officials should communicate and how identified information security violations will be reported as soon as possible by organisations.

Organisations that have been attacked over the internet may compel authorities to take counter-measures. Maintaining these connections may also be required in information security to assist incident management or business continuity and contingency planning operations. Contacts with regulatory authorities are also beneficial in predicting and planning for any changes in the rules or regulations that the organisation must enforce. You can consider to contact with your data protection regulator that is likely mandated in law, utility companies for power and water, health and safety if relevant, fire departments for business continuity and incident management, perhaps your telecoms provider for routing if lines go down.You are going to have to ensure that:

• you identify and document what authorities apply to you;
• in what circumstances you would contact them;
• how information security incidents should be reported if relevant;
• understand what expectations these authorities have, if any;
• include relevant contact steps in your incident management processes;
• include relevant contact steps in your business continuity and disaster recovery processes

The ISMS coordinator can keep records up to date and identify which and when contact is made by the appropriate relationship owner with specific contact circumstances, and the nature of the information provided. It should clearly identify who is responsible for contacting authorities (e.g., law enforcement, regulatory bodies, supervisory authorities), which authorities should be contacted (e.g., which region/country), and in what cases this needs to happen.

To evaluate compliance with A.5.4 "Management Responsibilities," an information security auditor would need to assess whether an organization's management has fulfilled their responsibilities for information security in line with applicable standards and best practices. Here is a list of evidence and areas that an auditor would typically review:

1. Information Security Policy: Review the organization's documented information security policy to ensure that it reflects management's commitment to information security, sets clear objectives, and provides a framework for implementation.

2. Senior Management Endorsement: Verify that senior management, such as the CEO or equivalent, has formally endorsed the information security policy and communicated its importance to the entire organization.

3. Governance Structure: Assess the organization's governance structure to determine how information security responsibilities are distributed among management levels and departments.

4. Risk Management: Review evidence of management's involvement in the organization's risk management process, including risk assessments, risk treatment decisions, and risk mitigation strategies.

5. Resource Allocation: Examine records that demonstrate management's allocation of adequate resources (financial, personnel, technology) to support the implementation of information security measures.

6. Security Roles and Responsibilities: Review how management has defined, communicated, and assigned information security roles and responsibilities throughout the organization.

7. Security Awareness and Training: Evaluate management's commitment to security awareness and training programs for employees at all levels, promoting a culture of security.

8. Incident Response: Verify that management has established an incident response plan that outlines roles, responsibilities, and procedures to address security incidents.

9. Continuous Improvement: Assess whether management actively participates in and supports ongoing improvement efforts for information security processes, controls, and practices.

10. Performance Metrics: Review evidence of management's establishment of key performance indicators (KPIs) or metrics to measure the effectiveness of information security initiatives.

11. Internal Communication: Examine how management communicates information security objectives, policies, and developments within the organization.

12. External Communication: Review how management communicates the organization's information security posture to external stakeholders, customers, partners, and regulatory authorities.

13. Compliance with Regulations: Verify that management ensures the organization complies with relevant laws, regulations, and contractual obligations related to information security.

14. Budget Allocation: Evaluate how management allocates funds for security-related activities, projects, and initiatives, ensuring that security needs are adequately funded.

15. Management Review: Review documentation of management's periodic reviews of the organization's information security performance, identifying strengths and areas for improvement.

16. Integration with Business Objectives: Assess whether information security objectives align with the organization's overall business objectives and strategies.

17. Vendor Management: Verify that management has established processes to assess and manage information security risks associated with third-party vendors and partners.

18. Audits and Assessments: Examine records of internal and external audits or assessments related to information security and management's response to findings and recommendations.

By examining these aspects, an auditor can determine whether management is actively engaged in promoting and overseeing information security practices, aligning them with the organization's strategic goals and ensuring the effective management of information security risks.