---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
type: control
id: "A.5.30"
title: "ICT readiness for business continuity"
theme: Organizational
control_type: [Corrective]
information_security_properties: [Availability]
cybersecurity_concepts: [Respond]
operational_capabilities: [Continuity]
security_domains: [Resilience]
tags:
- iso27002/2022/EN
- sourcetext
status: active
---

## 5.30 ICT readiness for business continuity

### Purpose

To ensure the availability of the organization’s information and other associated assets during disruption.

### Guidance

ICT readiness for business continuity is an important component in business continuity management and information security management to ensure that the organization’s objectives can continue to be met during disruption.

The ICT continuity requirements are the outcome of the business impact analysis (BIA). The BIA process should use impact types and criteria to assess the impacts over time resulting from the disruption of business activities that deliver products and services. The magnitude and duration of the resulting impact should be used to identify prioritized activities which should be assigned a recovery time objective (RTO). The BIA should then determine which resources are needed to support prioritized activities. An RTO should also be specified for these resources. A subset of these resources should include ICT services.

The BIA involving ICT services can be expanded to define performance and capacity requirements of ICT systems and recovery point objectives (RPO) of information required to support activities during disruption.

Based on the outputs from the BIA and risk assessment involving ICT services, the organization should identify and select ICT continuity strategies that consider options for before, during and after disruption. The business continuity strategies can comprise one or more solutions. Based on the strategies, plans should be developed, implemented and tested to meet the required availability level of ICT services and in the required time frames following interruption to, or failure of, critical processes.

The organization should ensure that:

a)   an adequate organizational structure is in place to prepare for, mitigate and respond to a disruption supported by personnel with the necessary responsibility, authority and competence;

b)   ICT continuity plans, including response and recovery procedures detailing how the organization is planning to manage an ICT service disruption, are:

1)   regularly evaluated through exercises and tests;
2)   approved by management;

c)   ICT continuity plans include the following ICT continuity information:

1)   performance and capacity specifications to meet the business continuity requirements and objectives as specified in the BIA;
2)   RTO of each prioritized ICT service and the procedures for restoring those components;
3)   RPO of the prioritized ICT resources defined as information and the procedures for restoring the information.

### Other information

Managing ICT continuity forms a key part of business continuity requirements concerning availability to be able to:

a)   respond and recover from disruption to ICT services regardless of the cause;

b)   ensure continuity of prioritized activities are supported by the required ICT services;

c)   respond before a disruption to ICT services occurs, and upon detection of at least one incident that can result in a disruption to ICT services.

Further guidance on ICT readiness for business continuity can be found in ISO/IEC 27031.

Further guidance on business continuity management systems can be found in ISO 22301 and ISO 22313. Further guidance on BIA can be found in ISO/TS 22317.
