Authorities and Interest Groups Contacts Template (ISO/IEC 27001 A.5.5, A.5.6)

Contacts register for A.5.5 and A.5.6: contact rules, authorities, CSIRTs, law enforcement, ISACs, vendor PSIRTs, restricted annex, verification log

ISMS・ISO/IEC 27001標準ISO/IEC 27001:2022 + Amd 1:2024 A.5.5, A.5.6 (cited only); ISO/IEC 27002:2022authority special interest contacts更新 2026/11/01

エディタで開く.mdをダウンロード

使い方: Use it when you set up incident response and threat intelligence, and verify incident contacts every quarter. Fill the authorities that impose duties on you first, from the legal register, then the groups that give warnings and threat information. The main pitfall is a list nobody has verified, found out of date during an incident.

プレビュー

Authorities and Special Interest Groups Contacts: [Organization name]

Register of the authorities and special interest groups the organization keeps contact with: regulators, data protection authorities, national CSIRTs, law enforcement, sector information sharing groups (ISACs), professional forums and suppliers' product security teams (PSIRTs). For each: why and when to contact, who may make contact, the route, what may be shared and when the entry was last verified. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A controls A.5.5 (contact with authorities) and A.5.6 (contact with special interest groups). Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice.

Document control

Field	Value
Document ID	DOC-ISMS-069
Version	[1.0]
Status	[Draft / Approved]
Owner	[@isms-manager]
Approvers/reviewers	[@legal-counsel], [@privacy-lead], [@security-operations-lead]
Last updated	YYYY-MM-DD
Classification	[Internal; contact annex Confidential]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024 (A.5.5, A.5.6); ISO/IEC 27002:2022
Review cadence	[Quarterly for incident contacts; annually for the full register]
Next scheduled review	YYYY-MM-DD

Approvals

Role	Name	Decision	Date
Owner	[@isms-manager]	[Prepared]	YYYY-MM-DD
Legal counsel	[@legal-counsel]	[Authority entries confirmed]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0	YYYY-MM-DD	[@owner]	First issue
[x.y]	YYYY-MM-DD	[@author]	[Change summary]

1. Rules for contact

Only the roles named as authorised in section 2 contact an authority on behalf of the organization. Others route requests through them.
Mandatory notifications follow the incident response plan (compliance/incident-response-plan) and are tracked in isms/incident-register section 4.
Information shared with special interest groups follows the group's sharing rules and the Traffic Light Protocol (FIRST TLP 2.0: TLP:RED, TLP:AMBER, TLP:AMBER+STRICT, TLP:GREEN, TLP:CLEAR). Remove personal data and customer names unless the recipient is entitled to them.
Every contact made during an incident is logged in the incident ticket with time, person, channel and content summary.
Inbound requests from authorities (for example law enforcement data requests) go to legal counsel before any data is disclosed.

2. Contacts register

2.1 Authorities (A.5.5)

Contact ID	Category	Organization	When to contact	Authorised contact	Route	Last verified	Next check
CNT-AUT-001 (Example)	Data protection authority	[Lead supervisory authority]	Personal data breach where we are controller and notification is required; prior consultation after a DPIA	Privacy lead or DPO	[Online breach portal; annex ref A-01]	2027-01-10	2027-04-10
CNT-AUT-002 (Example)	National CSIRT or competent authority	[National CSIRT under national NIS2 law]	Significant incident early warning, notification and final report; requests for assistance	Reporting owner, CISO	[Reporting portal and 24x7 line; annex ref A-02]	2027-01-10	2027-04-10
CNT-AUT-003 (Example)	Sector or financial supervisor	[Supervisor, if applicable]	Major ICT-related incident reporting under DORA (financial entities) or other sector rules; material outsourcing notices	Legal counsel	[Portal; annex ref A-03]	2027-01-10	2028-01-10
CNT-AUT-004 (Example)	Law enforcement	[National or regional cybercrime unit]	Extortion, fraud, insider theft, child abuse material found on systems	Legal counsel, CISO	[Reporting line; annex ref A-04]	2027-01-10	2027-04-10
CNT-AUT-005 (Example)	Emergency and civil services	[Local emergency services, utilities, building management]	Fire, flood, power loss, physical intrusion	Facilities lead	[Annex ref A-05]	2027-01-10	2027-04-10
CNT-AUT-006 (Example)	Certification body	[Accredited certification body]	Significant changes to the ISMS or scope, major incidents affecting certified scope, as the certification agreement requires	ISMS manager	[Client manager route; annex ref A-06]	2027-01-10	2028-01-10
CNT-AUT-007 (Example, if you place products with digital elements on the EU market)	CRA reporting	[ENISA Single Reporting Platform, routed to the CSIRT designated as coordinator]	Actively exploited vulnerability in our product or severe incident affecting its security (EU Cyber Resilience Act, Regulation (EU) 2024/2847, Art. 14; reporting applies from 2026-09-11)	Product security lead, reporting owner	[Platform account; annex ref A-07]	2027-01-10	2027-04-10

2.2 Special interest groups and security contacts (A.5.6)

Contact ID	Category	Organization	Purpose and when to contact	Authorised contact	Sharing rule	Last verified	Next check
CNT-SIG-001 (Example)	Sector ISAC	[Health sector ISAC]	Receive sector alerts; share indicators after an incident	Security operations lead	Group rules, TLP	2027-01-10	2027-04-10
CNT-SIG-002 (Example)	National or regional information sharing group	[Regional cyber security forum]	Threat briefings, peer exchange	ISMS manager	Chatham House rule, TLP	2027-01-10	2028-01-10
CNT-SIG-003 (Example)	Vendor PSIRT	[Identity provider security team]	Report a suspected product vulnerability or provider-side compromise	Security operations lead	Vendor disclosure policy; find routes in the vendor's security.txt (RFC 9116)	2027-01-10	2027-04-10
CNT-SIG-004 (Example)	Vendor PSIRT	[Public cloud provider security team]	Abuse reports, provider-side investigation, key leak reports	Platform lead	Provider support case	2027-01-10	2027-04-10
CNT-SIG-005 (Example)	Professional body	[ISC2 or ISACA local chapter]	Competence development, peer advice	Security team members	Public events	2027-01-10	2028-01-10
CNT-SIG-006 (Example)	Vulnerability and advisory feeds	[National CSIRT advisories, vendor advisory lists]	Daily input to `isms/threat-intelligence-procedure`	Security analyst on duty	Public	2027-01-10	2027-07-10
CNT-SIG-007 (Example)	Incident response partners	[Forensics retainer, cyber insurer]	Major incident support; insurer notice per policy terms	Incident commander	Contract terms	2027-01-10	2027-04-10

3. Contact annex (restricted)

Annex ref	Content	Storage (Example)	Access
A-01 to A-07	Portal URLs, account owners, 24x7 numbers, case reference formats for authorities	Password manager vault "IR contacts", printed copy in the incident kit	Incident commanders, privacy lead, legal counsel
A-08 onward	Group membership logins, PSIRT routes, retainer and insurer hotlines	Same vault	Security team

Portal accounts for authorities must have at least two named holders and must not depend on a single person's mailbox.

4. Verification and review

Check	Frequency (Example)	Method	Record
Incident-critical contacts (CNT-AUT-001, 002, 004, 007 where used, CNT-SIG-003, 004, 007)	Quarterly	Log in to portals; confirm numbers on the official website; test call where offered	Update "Last verified"; log in ticket
Full register	Annually and after a law or organization change	Review against the legal register and current memberships	New version of this document
Use during exercises	Each tabletop exercise	Responders use the annex, not a search engine	`security/tabletop-exercise` report
Membership value	Annually	Did the group give alerts or contacts we used? Keep, change or leave	Decision recorded in revision history

Example verification log:

Date	Contact ID	Result	Follow-up
2027-01-10 (Example)	CNT-AUT-002	Portal login works for both holders	None
2027-01-10 (Example)	CNT-SIG-003	security.txt route changed; annex updated	None
2027-01-10 (Example)	CNT-AUT-004	Old reporting number withdrawn; new route taken from the official site	Annex A-04 updated, responders informed

5. Size tiers

Aspect	Small: Quillmere Analytics Ltd (46 staff)	Medium: Quillmere Health Systems (320 staff)	Large: Quillmere Group (2,400 staff, 6 sites)
Typical entries (Example)	10: one data protection authority, national CSIRT, police cybercrime unit, cloud provider, identity provider, two advisory feeds, insurer, certification body, one professional chapter	18: the 10 above plus the health sector ISAC, a regional forum, the colocation provider, a forensics retainer and security contacts of 4 key hospital customers	45 or more: authorities per country (4 countries), OT vendor PSIRTs for the 3 plants, utility and emergency contacts per site
Owner	Head of Engineering Operations (0.5 FTE ISMS manager)	ISMS manager with the privacy lead	CISO office, with a site contact list per site
Review	Annual full review; quarterly portal checks	Quarterly incident contacts	Quarterly per site, consolidated centrally

6. Records and evidence

Record	Owner	Location (Example)	Retention (Example)
This register (all versions)	ISMS manager	ISMS document store	Certification cycle plus 1 year (at least 4 years)
Verification log	ISMS manager	Section 4 and tickets	Same as the register
Contacts made during incidents	Incident commander	Incident tickets linked from `isms/incident-register`	Same as the incident register
Shared intelligence and alerts received	Security operations lead	Threat intelligence records	Per `isms/threat-intelligence-procedure`

7. References

ISO/IEC 27001:2022 + Amd 1:2024: https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html
ISO/IEC 27002:2022: https://www.iso.org/standard/75652.html
ISO/IEC 27035-1:2023: https://www.iso.org/standard/78973.html
FIRST Traffic Light Protocol (TLP) version 2.0, authoritative from August 2022
RFC 9116, A File Format to Aid in Security Vulnerability Disclosure (security.txt), April 2022
Related templates: compliance/incident-response-plan (DOC-ISMS-020), isms/incident-register (DOC-ISMS-021), isms/threat-intelligence-procedure (DOC-ISMS-045), compliance/legal-register (DOC-ISMS-014), isms/crisis-management-communications-plan (DOC-ISMS-078), security/tabletop-exercise, isms/control-evidence-matrix (DOC-ISMS-033)

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (Annex A controls A.5.5 and A.5.6) and ISO/IEC 27002:2022. Control numbers are cited with original short labels only; no ISO or IEC text is reproduced, and you need the official standards to implement and audit the controls. The register structure, rules and examples are original; no real contact details are given. Check the current editions before use.

Template licence: MIT.