Key takeaways
- Know how and when to contact regulators, police and other authorities.
- During an incident or legal matter you need to know who to call at regulators, law enforcement and other authorities, quickly.
- Start here: identify the authorities relevant to you: data protection regulator, police cybercrime unit, sector regulators.
Purpose
Know how and when to contact regulators, police and other authorities.
Requirement
Requirement summaryThe organization shall establish and maintain contact with relevant authorities.
Why it matters
During an incident or legal matter you need to know who to call at regulators, law enforcement and other authorities, quickly.
How to implement
- Identify the authorities relevant to you: data protection regulator, police cybercrime unit, sector regulators.
- Record contact details and the situations that would trigger contact.
- Assign who is allowed to make contact on the organisation's behalf.
- Review the list at least yearly and after any regulatory change.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.5. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- A contact list for the authorities you may need to reach (police, regulators, the data protection authority), with phone numbers and email addresses.
- A short note on when you must contact them, such as reporting a data breach within a set time.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.5 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Proof the contact list was checked recently.
- Records of any contact made with authorities during incidents.
Things you should be able to show or explain
- Be able to say who is responsible for contacting the authorities and when.
How much to show: Check every contact on the list is current.
Common mistakes
- Out-of-date or missing contact list.
- No rules on when the authorities must be told.
- A contact list that is years out of date.
- No clarity on who is authorised to speak to regulators.
- Tip: Keep an up-to-date contact list next to your incident plan.
Policies & documents to have
- Incident Response Plan
FAQ
Is A.5.5 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.5?
Be ready to explain how the control works in your organisation and to provide things like: A contact list for the authorities you may need to reach (police, regulators, the data protection authority), with phone numbers and email addresses…