#iso27002/2022/EN
## 5.29 Information security during disruption

| Control type            | Information security properties           | Cybersecurity concepts | Operational capabilities | Security domains        |
| ----------------------- | ----------------------------------------- | ---------------------- | ------------------------ | ----------------------- |
| #Preventive #Corrective | #Confidentiality #Integrity #Availability | #Protect #Respond      | #Continuity              | #Protection #Resilience |

**Control**
The organization should plan how to maintain information security at an appropriate level during disruption.

**Purpose**
To protect information and other associated assets during disruption.

**Guidance**
The organization should determine its requirements for adapting information security controls during disruption. Information security requirements should be included in the business continuity management processes.

Plans should be developed, implemented, tested, reviewed and evaluated to maintain or restore the security of information of critical business processes following interruption or failure. Security of information should be restored at the required level and in the required time frames.

The organization should implement and maintain:

a\) information security controls, supporting systems and tools within business continuity and ICT continuity plans;

b\) processes to maintain existing information security controls during disruption;

c\) compensating controls for information security controls that cannot be maintained during disruption.

**Other information**
In the context of business continuity and ICT continuity planning, it can be necessary to adapt the information security requirements depending on the type of disruption, compared to normal operational conditions. As part of the business impact analysis and risk assessment performed within business continuity management, the consequences of loss of confidentiality and integrity of information should be considered and prioritized in addition to the need for maintaining availability.

Information on business continuity management systems can be found in ISO 22301 and ISO 22313. Further guidance on business impact analysis (BIA) can be found in ISO/TS 22317.