Information security management

This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.

What Annex A says

Annex A names information security management as a supporting discipline; it does not require a particular control set. For clause 5.8, the contribution is the protection of information as an asset: the records, plans, customer data and decision logs that the organization needs in a disruption. Availability matters as much as confidentiality. A continuity plan that cannot be read because the repository is down, or a decision log that cannot be trusted because it was altered, undermines the response. The discipline also supports the evidence integrity that an assessor relies on.

Why it matters

Information security is sometimes separated from resilience because one is about threats and the other about continuity. In practice they meet at availability and integrity. The resilience question is whether the information needed to respond is available when the primary systems are not, and whether the record of what happened can be trusted afterwards. That requires a classified information set, an offline or alternate access route and a retention rule.

What good looks like

Classify the information a core service and the resilience programme need. Record the owner, the retention rule and the alternate access route for each critical set. Test access without the primary system. Confirm that decision logs and incident records are tamper-evident. Review the classification when a service or a system changes. Include supplier-held information in the scope.

Evidence a reviewer asks for

There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.

An assessor will ask how the response team reads the plan when the document system is down. An availability plan that assumes the repository is up has not been tested.

• Information classification The critical information sets, their owners and the retention rule
• Alternate access How critical information is reached when the primary system is unavailable, with the test
• Integrity control How decision logs and incident records are protected from alteration
• Supplier information The information held by suppliers that a core service depends on, with the contractual protection

Where it commonly fails

• Critical information is not classified, so everything is treated the same.
• The continuity plan is stored only in the system it is meant to replace.
• Decision logs can be edited without a trace.

What to do before the second edition

Ask for the continuity plan with the network off. If you cannot get it, the alternate access route is a fiction.

Read across

• 5.6 Shared information and knowledge
• 5.7 Availability of resources
• 5.8 Development and coordination of management disciplines

← A.13 Human resources managementA.15 Information, communications and technology →

Full register / The dates / Free transition check