Annex A Controls Explained
ISO 27001 Control 5.5 Contact With Authorities
ISO 27001 requires organisations to identify and maintain a list of contacts with applicable law enforcement, regulatory and other authorities that oversee information security so that in the event of an issue, you know whom to contact and when.
Written By: Alan Parker, ISO 27001 Consultant
Last Updated: 11 May 2026
Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →
ISO 27001 Control 5.5 Contact with authorities: “The organization shall establish and maintain contact with relevant authorities.”
https://www.iso.org/standard/27001
Key Takeaways
- Keep a list of whom you need to contact and when, particularly for incidents.
- 5.5 isn’t just about regulators. It includes law enforcement, utility providers, emergency services, sector regulators, and your cyber insurer.
- The 72-hour ICO reporting window for personal data breaches is the most time-pressured authority contact most UK SMEs will face. Build the trigger and process for this specifically.
- Out-of-date contact details are a common audit finding on this control. Phone numbers and reporting URLs change; review the register at least annually.
- Document the trigger conditions, not just the contact details. Knowing who to call matters less than knowing when you have to call them.
- For most SMEs, a contact register inside your Incident Response Plan is enough. You don’t need a separate Emergency Contact Procedure unless you’re regulated or large.
Table of Contents
The Key Purpose of Control 5.5
When I walk organisations through their scope and the influences on their ISMS as part of my coaching programme, one of the questions I ask is: “Do you know what regulatory and legal frameworks you need to operate under, like GDPR, etc?” The answer is often no, but we dig in, identify the laws and obligations they have, and document them as part of that process. This control then asks you to maintain a list of who to contact and when.
The primary goals of control 5.5 are to:
- Facilitate consistent and timely communication about information security matters.
- Ensure compliance with legal, regulatory, and supervisory obligations.
- Prepare for and adapt to current and future regulatory expectations.
Between clause 4 and control 5.31 for Legal, statutory, regulatory, and contractual requirements, you need to identify the applicable laws, which is about ensuring you know who to contact and when. For example, under GDPR legislation in the UK, you may need to contact the ICO within a certain timeframe if you have a significant breach of personal data.
Ultimately, this stops you from scrabbling around during an incident to work out who to contact and why.
Control 5.5 isn’t just about knowing when and where to report incidents. The standard is also asking you to keep an eye on the future in other controls, so identification of authorities will support that (i.e subscribing to newsletters or keeping an eye on their websites). In 2026, that means watching what’s coming in NIS2 alignment, the Cyber Security and Resilience Bill, and the evolving UK approach to AI regulation.
A Useful Tool for The Identification of Worldwide Regulations
This tool is very useful for identifying application laws and regulations. I’d just say that country-level regulations are not enough. I’ve worked with teams who have obligations at a state/county level, for example, the Massachusetts Data Privacy Act, which impacted them as they had staff from the state, and they had no idea about it.
Guidelines for Establishing Contact
I’d suggest that organisations develop a file containing clear protocols for triggering interactions with authorities, detailing:
When to Initiate Contact
Define when to trigger the contact. For example, with the ICO, you need to contact them within 72 hours in usual circumstances, but not just for any breach; there are certain criteria, and they have tools on their website to help you decide. It’s things like this that you should try to identify before you need them in a panic. It’ll stop major mistakes in the heat of action (i.e., reporting things that don’t need to be reported, or reporting at the wrong times).
The couple that come to mind are;
- Insurance companies for cyber response services
- ICO / GDPR regulators in the EU / UK
- Regulatory bodies like the FCA (Financial Conduct Authority) or others.
Define a Designated Point of Contact
If things do go sideways, then make sure you are clear about who can contact third parties. You don’t want a junior member of staff jumping to a conclusion and reporting to the ICO before the management team has been informed.
Incident Reporting Procedures
You should have an incident management (and I’d always suggest a Major Incident Management process). As part of these, make sure you have documented procedures for incident reporting, which should include:
- Detailed descriptions of the incident.
- Mitigation steps taken.
- Key contact information for follow-up communication.
When you engage with an authority, they will want succinct and accurate information, so you don’t want to be scrabbling around to find this and conducting a postmortem in the middle of an incident. Make sure that records are kept as the incident unfolds.
An Example Authority Contact Table
Here’s an example of the kind of thing you could create using the above criteria.
| Authority | When to contact them | How to contact | Timeframe |
|---|---|---|---|
| Information Commissioner’s Office (ICO) | Personal data breach affecting UK or EU residents that’s likely to result in risk to individuals | ico.org.uk/make-a-complaint or 0303 123 1113 | Within 72 hours of becoming aware |
| Action Fraud | Cyber-enabled crime (ransomware, fraud, business email compromise, theft of company funds) | actionfraud.police.uk or 0300 123 2040 | As soon as practical; out-of-hours reporting available online |
| National Cyber Security Centre (NCSC) | Significant cyber incident affecting UK national interest, critical services, or large numbers of citizens | ncsc.gov.uk/section/about-this-website/contact-us | As soon as you have a credible picture of the incident |
| Local police force | Theft of physical assets, insider crime, threats to staff | 101 (non-emergency) or 999 if an immediate threat | Immediately for active incidents |
| Sector regulator (FCA, MHRA, Ofcom, etc.) | Regulated firms only: incidents within scope of sector reporting rules | Per your sector’s reporting framework | Per your sector’s specific timeframe |
| Your insurer (cyber and PI) | Any incident likely to trigger a claim or that the policy requires you to notify | Per the contact details on your policy schedule | Per the policy wording, often within 24-48 hours |
Benefits of Maintaining Authority Relationships
The benefits of maintaining a register of authorities are in three main parts;
Improved Regulatory Compliance
Per my earlier comments, you need to ensure you have identified your regulatory compliance obligations. By identifying what you need to do, regular communication (be it review or otherwise) with regulatory bodies enables organisations to:
- Stay informed about new changes to laws and regulations.
- Anticipate upcoming compliance requirements to reduce the risk of violations.
These are things an auditor will expect you to do at least annually, so maintaining the register here alongside control 5.31 and the identification of legal, statutory, regulatory and contractual requirements – you should be well covered.
Enhanced Incident Response
If you have a register of the contacts, then during security incidents, when all hell breaks loose, you will naturally have much better control and won’t be running around panicking, so the register acts as a ‘break glass in case of emergency’ backup to that process. You’ll have:
- Faster escalation of issues to the appropriate bodies.
- Expert support for containment and resolution efforts.
- Assistance in taking action against sources of attacks, when applicable.
Strengthened Business Continuity
And the same holds true in the event of a major business disruption. You’ll likely need to contact insurers, who may have their own protocols to follow, and even initiate services to support you in recovery. For example, in the event of a major ransomware event.
Common Issues I Find During Internal Audits
So, this isn’t a hugely complicated control, and there isn’t really that much to check, but if there isn’t a register, that’s an obvious issue. Besides that, I know an auditor who always asks, “What about your insurance company?” Every time I see him in an audit…
Otherwise, the key issue might be that the contact list lives in someone’s head (or on their phone), not in writing and accessible to others.
Finally, you could trip up if there’s no record kept of contact made when an incident did occur, so when an auditor asks ‘did you report the May incident to anyone?’, you can’t prove it.
How does ISO 27001 Control 5.5 link to other clauses and controls
I’ve touched on these, but this control links to the following;
- Clause 4 – Context of the Organisation (where you identify regulatory obligations)
- Clause 6.1 – Risk Assessment (which feeds the list of relevant authorities)
- Annex A 5.6 – Special Interest Groups (the sister control)
- Annex A 5.24 / 5.25 / 5.26 – Incident Management cluster (the operational use case for 5.5)
- Annex A 5.31 – Legal, statutory, regulatory and contractual requirements (the upstream control that identifies the authorities)
- Annex A 6.3 – Awareness training (because staff need to know who to escalate to)
FAQs
What is the objective of Control 5.5 in ISO 27001?
This control ensures your organisation knows how and when to contact authorities, such as regulators, law enforcement, or data protection agencies. It helps you respond appropriately to incidents, investigations, or compliance requirements.
Which authorities are relevant under this control?
Some examples might be;
– Data protection regulators (e.g. the ICO in the UK)
– Cybersecurity or national security agencies
– Law enforcement
– Regulatory bodies tied to your industry (e.g. FCA, NHS Digital)
– Incident reporting authorities (like the NCSC)
Why is Control 5.5 important for information security?
When a major incident breaks out, and you are scrabbling around to work out what to do next, having a list of who, when and triggers that you can easily refer to can save you a real headache in the heat of a situation. It’s useful to you, and shows the auditors that you know where to go and when.
What should we do to comply with this control?
You should identify the authorities relevant to your operations, maintain up-to-date contact details, define when and how to engage them (e.g. in your incident response plan) and train staff to follow the process in the event of an issue
How does this link with other ISO 27001 controls?
It connects most closely with:
– Control 5.7 (Threat Intelligence) – for sharing threat data
– Control 5.6 (Special Interest Groups) – for collaborative response
– Control 5.28 (Security Incidents) – for reporting and response
Together, they ensure you’re prepared, compliant, and responsive.
Conclusion
Control 5.5 is one of the simpler Annex A controls, but it’s one of the ones you’ll be most grateful for when something actually goes wrong. The middle of an incident is the worst possible time to be working out who to call, which timeframe applies, and where the phone number is located.
A short, current authority contact register, integrated with your incident response process, satisfies the control and gives you something genuinely useful operationally. Document the trigger conditions, name a contact owner per authority, keep the contact details current, and review the register annually. That’s most of what auditors look for, and it’s most of what you’d want for yourself when standing up an incident response.
If you’d like a ready-made authority contact register template alongside the wider incident response documents, the Iseo Blue ISO 27001 Toolkit includes both. Or if you’d rather talk through which authorities are relevant to your specific business and how to set up the reporting triggers, the free 30-minute consultation is genuinely free and genuinely 30 minutes.
Author Background
This article was written by Alan Parker, an ISO 27001 consultant and founder of Iseo Blue Limited. He helps UK SMEs achieve certification in 90 days or less, often without a dedicated security team or a large budget.
With over 30 years in IT governance and information security, Alan works with software companies, IT service providers, managed service providers, and professional services firms across the UK, Europe, and internationally.
Qualifications: Certified ISO 27001 Lead Auditor (ANAB-accredited certification),
ITIL v3 Expert, ITIL v4 Bridge, PRINCE2 Practitioner. Named IT Project Expert of the Year (2024, UK). Alan writes in plain English for busy teams who need to get things done.
Connect on LinkedIn or Bluesky, or explore his free ISO 27001 tools and templates at iseoblue.com. B.Sc (Hons) Information Systems, CISMP certified.
