The Common Misconception
Many teams think ISO 27001 requires a full-blown business continuity management system (BCMS). It doesn't. That's ISO 22301. What ISO 27001 requires is that information security is considered within your business continuity arrangements.
What ISO 27001 Actually Requires
Annex A.5.29 — Information Security During Disruption
Your business continuity plans must address how you maintain information security when things go wrong.
Annex A.5.30 — ICT Readiness for Business Continuity
Your IT systems need to be resilient enough to support business continuity requirements.
Annex A.8.13 — Information Backup
Regular backups with tested restoration procedures.
Annex A.8.14 — Redundancy
Sufficient redundancy in information processing facilities.
A Pragmatic Approach
1. Business Impact Analysis (Simplified)
Identify your critical systems and processes:
•What systems are essential for operations?
•What's the maximum acceptable downtime (RTO)?
•How much data loss is acceptable (RPO)?
•What are the dependencies?
2. Continuity Plans
For each critical system:
•What happens if it's unavailable?
•What's the workaround?
•Who's responsible for recovery?
•What's the communication plan?
3. Backup & Recovery
•Automated backups with defined frequency
•Off-site or cloud backup storage
•Regular restoration testing (not just backup verification)
•Documented recovery procedures
4. Testing
•Test backup restorations quarterly
•Review continuity plans annually
•Conduct at least one scenario exercise per year
What Auditors Want to See
•Evidence that you've identified critical systems
•Documented recovery procedures
•Backup logs and restoration test results
•That continuity plans address information security
•Evidence of regular review and testing
Common Mistakes
•Having no backup restoration test evidence
•Continuity plans that forget about security (e.g., relaxing access controls during recovery)
•Not considering cloud service provider outages
•Plans that exist on paper but haven't been communicated to the team