Authorities and Interest Groups Contacts Template (ISO/IEC 27001 A.5.5, A.5.6)
Contacts register for A.5.5 and A.5.6: contact rules, authorities, CSIRTs, law enforcement, ISACs, vendor PSIRTs, restricted annex, verification log
SMKI & ISO/IEC 27001StandarISO/IEC 27001:2022 + Amd 1:2024 A.5.5, A.5.6 (cited only); ISO/IEC 27002:2022authorityspecialinterestcontacts
Cara menggunakan: Use it when you set up incident response and threat intelligence, and verify incident contacts every quarter. Fill the authorities that impose duties on you first, from the legal register, then the groups that give warnings and threat information. The main pitfall is a list nobody has verified, found out of date during an incident.
Pratinjau
Authorities and Special Interest Groups Contacts: [Organization name]
Register of the authorities and special interest groups the organization keeps contact with: regulators, data protection authorities, national CSIRTs, law enforcement, sector information sharing groups (ISACs), professional forums and suppliers' product security teams (PSIRTs). For each: why and when to contact, who may make contact, the route, what may be shared and when the entry was last verified. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A controls A.5.5 (contact with authorities) and A.5.6 (contact with special interest groups). Replace every
[bracketed]value and every row marked Example. This is a documentation format, not legal advice.
Document control
| Field | Value |
|---|---|
| Document ID | DOC-ISMS-069 |
| Version | [1.0] |
| Status | [Draft / Approved] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@legal-counsel], [@privacy-lead], [@security-operations-lead] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal; contact annex Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 (A.5.5, A.5.6); ISO/IEC 27002:2022 |
| Review cadence | [Quarterly for incident contacts; annually for the full register] |
| Next scheduled review | YYYY-MM-DD |
Approvals
| Role | Name | Decision | Date |
|---|---|---|---|
| Owner | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Legal counsel | [@legal-counsel] | [Authority entries confirmed] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | YYYY-MM-DD | [@owner] | First issue |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |
1. Rules for contact
- Only the roles named as authorised in section 2 contact an authority on behalf of the organization. Others route requests through them.
- Mandatory notifications follow the incident response plan
(
compliance/incident-response-plan) and are tracked inisms/incident-registersection 4. - Information shared with special interest groups follows the group's sharing rules and the Traffic Light Protocol (FIRST TLP 2.0: TLP:RED, TLP:AMBER, TLP:AMBER+STRICT, TLP:GREEN, TLP:CLEAR). Remove personal data and customer names unless the recipient is entitled to them.
- Every contact made during an incident is logged in the incident ticket with time, person, channel and content summary.
- Inbound requests from authorities (for example law enforcement data requests) go to legal counsel before any data is disclosed.
2. Contacts register
2.1 Authorities (A.5.5)
| Contact ID | Category | Organization | When to contact | Authorised contact | Route | Last verified | Next check |
|---|---|---|---|---|---|---|---|
| CNT-AUT-001 (Example) | Data protection authority | [Lead supervisory authority] | Personal data breach where we are controller and notification is required; prior consultation after a DPIA | Privacy lead or DPO | [Online breach portal; annex ref A-01] | 2027-01-10 | 2027-04-10 |
| CNT-AUT-002 (Example) | National CSIRT or competent authority | [National CSIRT under national NIS2 law] | Significant incident early warning, notification and final report; requests for assistance | Reporting owner, CISO | [Reporting portal and 24x7 line; annex ref A-02] | 2027-01-10 | 2027-04-10 |
| CNT-AUT-003 (Example) | Sector or financial supervisor | [Supervisor, if applicable] | Major ICT-related incident reporting under DORA (financial entities) or other sector rules; material outsourcing notices | Legal counsel | [Portal; annex ref A-03] | 2027-01-10 | 2028-01-10 |
| CNT-AUT-004 (Example) | Law enforcement | [National or regional cybercrime unit] | Extortion, fraud, insider theft, child abuse material found on systems | Legal counsel, CISO | [Reporting line; annex ref A-04] | 2027-01-10 | 2027-04-10 |
| CNT-AUT-005 (Example) | Emergency and civil services | [Local emergency services, utilities, building management] | Fire, flood, power loss, physical intrusion | Facilities lead | [Annex ref A-05] | 2027-01-10 | 2027-04-10 |
| CNT-AUT-006 (Example) | Certification body | [Accredited certification body] | Significant changes to the ISMS or scope, major incidents affecting certified scope, as the certification agreement requires | ISMS manager | [Client manager route; annex ref A-06] | 2027-01-10 | 2028-01-10 |
| CNT-AUT-007 (Example, if you place products with digital elements on the EU market) | CRA reporting | [ENISA Single Reporting Platform, routed to the CSIRT designated as coordinator] | Actively exploited vulnerability in our product or severe incident affecting its security (EU Cyber Resilience Act, Regulation (EU) 2024/2847, Art. 14; reporting applies from 2026-09-11) | Product security lead, reporting owner | [Platform account; annex ref A-07] | 2027-01-10 | 2027-04-10 |
2.2 Special interest groups and security contacts (A.5.6)
| Contact ID | Category | Organization | Purpose and when to contact | Authorised contact | Sharing rule | Last verified | Next check |
|---|---|---|---|---|---|---|---|
| CNT-SIG-001 (Example) | Sector ISAC | [Health sector ISAC] | Receive sector alerts; share indicators after an incident | Security operations lead | Group rules, TLP | 2027-01-10 | 2027-04-10 |
| CNT-SIG-002 (Example) | National or regional information sharing group | [Regional cyber security forum] | Threat briefings, peer exchange | ISMS manager | Chatham House rule, TLP | 2027-01-10 | 2028-01-10 |
| CNT-SIG-003 (Example) | Vendor PSIRT | [Identity provider security team] | Report a suspected product vulnerability or provider-side compromise | Security operations lead | Vendor disclosure policy; find routes in the vendor's security.txt (RFC 9116) | 2027-01-10 | 2027-04-10 |
| CNT-SIG-004 (Example) | Vendor PSIRT | [Public cloud provider security team] | Abuse reports, provider-side investigation, key leak reports | Platform lead | Provider support case | 2027-01-10 | 2027-04-10 |
| CNT-SIG-005 (Example) | Professional body | [ISC2 or ISACA local chapter] | Competence development, peer advice | Security team members | Public events | 2027-01-10 | 2028-01-10 |
| CNT-SIG-006 (Example) | Vulnerability and advisory feeds | [National CSIRT advisories, vendor advisory lists] | Daily input to isms/threat-intelligence-procedure | Security analyst on duty | Public | 2027-01-10 | 2027-07-10 |
| CNT-SIG-007 (Example) | Incident response partners | [Forensics retainer, cyber insurer] | Major incident support; insurer notice per policy terms | Incident commander | Contract terms | 2027-01-10 | 2027-04-10 |
3. Contact annex (restricted)
| Annex ref | Content | Storage (Example) | Access |
|---|---|---|---|
| A-01 to A-07 | Portal URLs, account owners, 24x7 numbers, case reference formats for authorities | Password manager vault "IR contacts", printed copy in the incident kit | Incident commanders, privacy lead, legal counsel |
| A-08 onward | Group membership logins, PSIRT routes, retainer and insurer hotlines | Same vault | Security team |
Portal accounts for authorities must have at least two named holders and must not depend on a single person's mailbox.
4. Verification and review
| Check | Frequency (Example) | Method | Record |
|---|---|---|---|
| Incident-critical contacts (CNT-AUT-001, 002, 004, 007 where used, CNT-SIG-003, 004, 007) | Quarterly | Log in to portals; confirm numbers on the official website; test call where offered | Update "Last verified"; log in ticket |
| Full register | Annually and after a law or organization change | Review against the legal register and current memberships | New version of this document |
| Use during exercises | Each tabletop exercise | Responders use the annex, not a search engine | security/tabletop-exercise report |
| Membership value | Annually | Did the group give alerts or contacts we used? Keep, change or leave | Decision recorded in revision history |
Example verification log:
| Date | Contact ID | Result | Follow-up |
|---|---|---|---|
| 2027-01-10 (Example) | CNT-AUT-002 | Portal login works for both holders | None |
| 2027-01-10 (Example) | CNT-SIG-003 | security.txt route changed; annex updated | None |
| 2027-01-10 (Example) | CNT-AUT-004 | Old reporting number withdrawn; new route taken from the official site | Annex A-04 updated, responders informed |
5. Size tiers
| Aspect | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large: Quillmere Group (2,400 staff, 6 sites) |
|---|---|---|---|
| Typical entries (Example) | 10: one data protection authority, national CSIRT, police cybercrime unit, cloud provider, identity provider, two advisory feeds, insurer, certification body, one professional chapter | 18: the 10 above plus the health sector ISAC, a regional forum, the colocation provider, a forensics retainer and security contacts of 4 key hospital customers | 45 or more: authorities per country (4 countries), OT vendor PSIRTs for the 3 plants, utility and emergency contacts per site |
| Owner | Head of Engineering Operations (0.5 FTE ISMS manager) | ISMS manager with the privacy lead | CISO office, with a site contact list per site |
| Review | Annual full review; quarterly portal checks | Quarterly incident contacts | Quarterly per site, consolidated centrally |
6. Records and evidence
| Record | Owner | Location (Example) | Retention (Example) |
|---|---|---|---|
| This register (all versions) | ISMS manager | ISMS document store | Certification cycle plus 1 year (at least 4 years) |
| Verification log | ISMS manager | Section 4 and tickets | Same as the register |
| Contacts made during incidents | Incident commander | Incident tickets linked from isms/incident-register | Same as the incident register |
| Shared intelligence and alerts received | Security operations lead | Threat intelligence records | Per isms/threat-intelligence-procedure |
7. References
- ISO/IEC 27001:2022 + Amd 1:2024: https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html
- ISO/IEC 27002:2022: https://www.iso.org/standard/75652.html
- ISO/IEC 27035-1:2023: https://www.iso.org/standard/78973.html
- FIRST Traffic Light Protocol (TLP) version 2.0, authoritative from August 2022
- RFC 9116, A File Format to Aid in Security Vulnerability Disclosure (security.txt), April 2022
- Related templates:
compliance/incident-response-plan(DOC-ISMS-020),isms/incident-register(DOC-ISMS-021),isms/threat-intelligence-procedure(DOC-ISMS-045),compliance/legal-register(DOC-ISMS-014),isms/crisis-management-communications-plan(DOC-ISMS-078),security/tabletop-exercise,isms/control-evidence-matrix(DOC-ISMS-033)
Standard and licence note
Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (Annex A controls A.5.5 and A.5.6) and ISO/IEC 27002:2022. Control numbers are cited with original short labels only; no ISO or IEC text is reproduced, and you need the official standards to implement and audit the controls. The register structure, rules and examples are original; no real contact details are given. Check the current editions before use.
Template licence: MIT.
Templat terkait
SMKI & ISO/IEC 27001
Access Control Policy Template (ISO/IEC 27001 A.5.15)
Access principles, role catalogue, joiner mover leaver SLAs, MFA and NIST SP 800-63B-4 password rules, privileged and service accounts, reviews, metrics
SMKI & ISO/IEC 27001Annex A Organizational Controls Guide Template (ISO/IEC 27001 A.5)
A.5.1 to A.5.37 in own words: intent, typical implementation, tier notes, evidence auditors sample, pitfalls, linked templates, self-check, study record
SMKI & ISO/IEC 27001Annex A People and Physical Controls Guide Template (ISO/IEC 27001 A.6, A.7)
A.6.1 to A.6.8 and A.7.1 to A.7.14 in own words: intent, tier notes, evidence, pitfalls, physical boundary decision for cloud and colocation, self-check, study record