ISO 27001:2022 · Organizational controls
ISO 27001:2022 5.5: Contact with authorities
ISO 27001:2022 5.5 covers Contact with authorities. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.5.5, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Contact details are stale or held only by one individual.
The organization is to set up and keep up working contact with the authorities that are relevant to it. Purpose (stated in ISO/IEC 27002:2022): ensures information security information flows properly between the organization and legal, regulatory and supervisory authorities. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.5.
What evidence supports 5.5?
- Annex A organizational controlStatement of Applicability entry for control A.5.5, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A organizational controlA register of relevant authorities (law enforcement, regulators, supervisory bodies, utilities, emergency services) with current contact details
- Annex A organizational controlA procedure stating when each authority is contacted, by whom, and the reporting timelines for incidents
- Annex A organizational controlRecords of incident notifications made to authorities and their timing
- Annex A organizational controlRecords of engagement used to track current and upcoming regulatory expectations
Where this requirement comes from
This is our own statement of ISO 27001:2022 5.5, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Contact details are stale or held only by one individual
- No defined decision point or owner for notifying a regulator, so notifications miss statutory deadlines
- Utilities and emergency services are omitted from the continuity contact list
- Regulatory horizon scanning is not linked to the authority relationships
How it maps to SOC 2
- CC2.3 high Contact with authorities is defined external communication about security matters.
- P6.6 high Contact with authorities is the regulator notification channel for breaches.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.