---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
type: control
id: "A.5.29"
title: "Information security during disruption"
theme: Organizational
control_type:
  - Preventive
  - Corrective
information_security_properties:
  - Confidentiality
  - Integrity
  - Availability
cybersecurity_concepts:
  - Protect
  - Respond
operational_capabilities: [Continuity]
security_domains:
  - Protection
  - Resilience
tags:
- iso27002/2022/EN
- sourcetext
status: active
---

## 5.29 Information security during disruption

### Control
The organization should plan how to maintain information security at an appropriate level during disruption.

### Purpose
To protect information and other associated assets during disruption.

### Guidance
The organization should determine its requirements for adapting information security controls during disruption. Information security requirements should be included in the business continuity management processes.

Plans should be developed, implemented, tested, reviewed and evaluated to maintain or restore the security of information of critical business processes following interruption or failure. Security of information should be restored at the required level and in the required time frames.

The organization should implement and maintain:

a\) information security controls, supporting systems and tools within business continuity and ICT continuity plans;

b\) processes to maintain existing information security controls during disruption;

c\) compensating controls for information security controls that cannot be maintained during disruption.

### Other information
In the context of business continuity and ICT continuity planning, it can be necessary to adapt the information security requirements depending on the type of disruption, compared to normal operational conditions. As part of the business impact analysis and risk assessment performed within business continuity management, the consequences of loss of confidentiality and integrity of information should be considered and prioritized in addition to the need for maintaining availability.

Information on business continuity management systems can be found in ISO 22301 and ISO 22313. Further guidance on business impact analysis (BIA) can be found in ISO/TS 22317.