# Authorities and Special Interest Groups Contacts: [Organization name]

> Register of the authorities and special interest groups the
> organization keeps contact with: regulators, data protection
> authorities, national CSIRTs, law enforcement, sector information
> sharing groups (ISACs), professional forums and suppliers' product
> security teams (PSIRTs). For each: why and when to contact, who may
> make contact, the route, what may be shared and when the entry was
> last verified. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A
> controls A.5.5 (contact with authorities) and A.5.6 (contact with
> special interest groups). Replace every `[bracketed]` value and every
> row marked *Example*. This is a documentation format, not legal
> advice.

<!--
Guidance: How to use this template
- Use it when you set up incident response and threat intelligence, and
  review it at least quarterly for the contacts used in incidents.
- Fill first: the authorities that impose duties on you, taken from the
  legal register (`compliance/legal-register`, DOC-ISMS-014), then the
  groups that give you warnings and threat information.
- Main pitfall: a list of names that nobody has verified. Contacts
  change, portals move, and the moment you need a number is the worst
  moment to search for it. Record a "last verified" date and test the
  routes.
- Use roles and generic categories here; do not store personal phone
  numbers. Real numbers and portal accounts live in the restricted
  contact annex referenced in section 3.
- Related templates: `compliance/incident-response-plan` (DOC-ISMS-020),
  `isms/incident-register` (DOC-ISMS-021),
  `isms/threat-intelligence-procedure` (DOC-ISMS-045),
  `compliance/legal-register` (DOC-ISMS-014),
  `isms/crisis-management-communications-plan` (DOC-ISMS-078),
  `isms/control-evidence-matrix` (DOC-ISMS-033).
-->

## Document control

<!-- Guidance: Owner is usually the ISMS manager or security operations lead; the privacy lead and legal counsel review the authority entries. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-069 |
| Version | [1.0] |
| Status | [Draft / Approved] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@legal-counsel], [@privacy-lead], [@security-operations-lead] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal; contact annex Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 (A.5.5, A.5.6); ISO/IEC 27002:2022 |
| Review cadence | [Quarterly for incident contacts; annually for the full register] |
| Next scheduled review | YYYY-MM-DD |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Owner | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Legal counsel | [@legal-counsel] | [Authority entries confirmed] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | YYYY-MM-DD | [@owner] | First issue |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |

## 1. Rules for contact

<!-- Guidance: State who may speak for the organization. Unplanned contact with a regulator or the press during an incident can create commitments nobody approved. Auditors check that the rules exist and that contacts are used as the rules say. -->

1. Only the roles named as **authorised** in section 2 contact an
   authority on behalf of the organization. Others route requests
   through them.
2. Mandatory notifications follow the incident response plan
   (`compliance/incident-response-plan`) and are tracked in
   `isms/incident-register` section 4.
3. Information shared with special interest groups follows the group's
   sharing rules and the Traffic Light Protocol (FIRST TLP 2.0:
   TLP:RED, TLP:AMBER, TLP:AMBER+STRICT, TLP:GREEN, TLP:CLEAR). Remove
   personal data and customer names unless the recipient is entitled to
   them.
4. Every contact made during an incident is logged in the incident
   ticket with time, person, channel and content summary.
5. Inbound requests from authorities (for example law enforcement data
   requests) go to legal counsel before any data is disclosed.

## 2. Contacts register

<!-- Guidance: One row per organization or group. Use roles, not names, in "Authorised contact" and record the route type here; keep numbers and accounts in the annex. "When to contact" should name concrete triggers. Pitfall: listing groups you joined years ago and never read. -->

### 2.1 Authorities (A.5.5)

| Contact ID | Category | Organization | When to contact | Authorised contact | Route | Last verified | Next check |
|---|---|---|---|---|---|---|---|
| CNT-AUT-001 *(Example)* | Data protection authority | [Lead supervisory authority] | Personal data breach where we are controller and notification is required; prior consultation after a DPIA | Privacy lead or DPO | [Online breach portal; annex ref A-01] | 2027-01-10 | 2027-04-10 |
| CNT-AUT-002 *(Example)* | National CSIRT or competent authority | [National CSIRT under national NIS2 law] | Significant incident early warning, notification and final report; requests for assistance | Reporting owner, CISO | [Reporting portal and 24x7 line; annex ref A-02] | 2027-01-10 | 2027-04-10 |
| CNT-AUT-003 *(Example)* | Sector or financial supervisor | [Supervisor, if applicable] | Major ICT-related incident reporting under DORA (financial entities) or other sector rules; material outsourcing notices | Legal counsel | [Portal; annex ref A-03] | 2027-01-10 | 2028-01-10 |
| CNT-AUT-004 *(Example)* | Law enforcement | [National or regional cybercrime unit] | Extortion, fraud, insider theft, child abuse material found on systems | Legal counsel, CISO | [Reporting line; annex ref A-04] | 2027-01-10 | 2027-04-10 |
| CNT-AUT-005 *(Example)* | Emergency and civil services | [Local emergency services, utilities, building management] | Fire, flood, power loss, physical intrusion | Facilities lead | [Annex ref A-05] | 2027-01-10 | 2027-04-10 |
| CNT-AUT-006 *(Example)* | Certification body | [Accredited certification body] | Significant changes to the ISMS or scope, major incidents affecting certified scope, as the certification agreement requires | ISMS manager | [Client manager route; annex ref A-06] | 2027-01-10 | 2028-01-10 |
| CNT-AUT-007 *(Example, if you place products with digital elements on the EU market)* | CRA reporting | [ENISA Single Reporting Platform, routed to the CSIRT designated as coordinator] | Actively exploited vulnerability in our product or severe incident affecting its security (EU Cyber Resilience Act, Regulation (EU) 2024/2847, Art. 14; reporting applies from 2026-09-11) | Product security lead, reporting owner | [Platform account; annex ref A-07] | 2027-01-10 | 2027-04-10 |

### 2.2 Special interest groups and security contacts (A.5.6)

| Contact ID | Category | Organization | Purpose and when to contact | Authorised contact | Sharing rule | Last verified | Next check |
|---|---|---|---|---|---|---|---|
| CNT-SIG-001 *(Example)* | Sector ISAC | [Health sector ISAC] | Receive sector alerts; share indicators after an incident | Security operations lead | Group rules, TLP | 2027-01-10 | 2027-04-10 |
| CNT-SIG-002 *(Example)* | National or regional information sharing group | [Regional cyber security forum] | Threat briefings, peer exchange | ISMS manager | Chatham House rule, TLP | 2027-01-10 | 2028-01-10 |
| CNT-SIG-003 *(Example)* | Vendor PSIRT | [Identity provider security team] | Report a suspected product vulnerability or provider-side compromise | Security operations lead | Vendor disclosure policy; find routes in the vendor's security.txt (RFC 9116) | 2027-01-10 | 2027-04-10 |
| CNT-SIG-004 *(Example)* | Vendor PSIRT | [Public cloud provider security team] | Abuse reports, provider-side investigation, key leak reports | Platform lead | Provider support case | 2027-01-10 | 2027-04-10 |
| CNT-SIG-005 *(Example)* | Professional body | [ISC2 or ISACA local chapter] | Competence development, peer advice | Security team members | Public events | 2027-01-10 | 2028-01-10 |
| CNT-SIG-006 *(Example)* | Vulnerability and advisory feeds | [National CSIRT advisories, vendor advisory lists] | Daily input to `isms/threat-intelligence-procedure` | Security analyst on duty | Public | 2027-01-10 | 2027-07-10 |
| CNT-SIG-007 *(Example)* | Incident response partners | [Forensics retainer, cyber insurer] | Major incident support; insurer notice per policy terms | Incident commander | Contract terms | 2027-01-10 | 2027-04-10 |

## 3. Contact annex (restricted)

<!-- Guidance: Keep the actual numbers, e-mail routes and portal accounts in a restricted annex that is available offline (printed in the incident kit, or in an encrypted file on responders' devices), because the corporate network may be down during an incident. -->

| Annex ref | Content | Storage *(Example)* | Access |
|---|---|---|---|
| A-01 to A-07 | Portal URLs, account owners, 24x7 numbers, case reference formats for authorities | Password manager vault "IR contacts", printed copy in the incident kit | Incident commanders, privacy lead, legal counsel |
| A-08 onward | Group membership logins, PSIRT routes, retainer and insurer hotlines | Same vault | Security team |

Portal accounts for authorities must have at least two named holders and
must not depend on a single person's mailbox.

## 4. Verification and review

<!-- Guidance: Verification means a real test: log in to the portal, call the line during office hours, confirm the address on the authority's official site. Record the result. Auditors look for the dates and any failed checks with follow-up. -->

| Check | Frequency *(Example)* | Method | Record |
|---|---|---|---|
| Incident-critical contacts (CNT-AUT-001, 002, 004, 007 where used, CNT-SIG-003, 004, 007) | Quarterly | Log in to portals; confirm numbers on the official website; test call where offered | Update "Last verified"; log in ticket |
| Full register | Annually and after a law or organization change | Review against the legal register and current memberships | New version of this document |
| Use during exercises | Each tabletop exercise | Responders use the annex, not a search engine | `security/tabletop-exercise` report |
| Membership value | Annually | Did the group give alerts or contacts we used? Keep, change or leave | Decision recorded in revision history |

*Example* verification log:

| Date | Contact ID | Result | Follow-up |
|---|---|---|---|
| 2027-01-10 *(Example)* | CNT-AUT-002 | Portal login works for both holders | None |
| 2027-01-10 *(Example)* | CNT-SIG-003 | security.txt route changed; annex updated | None |
| 2027-01-10 *(Example)* | CNT-AUT-004 | Old reporting number withdrawn; new route taken from the official site | Annex A-04 updated, responders informed |

## 5. Size tiers

<!-- Guidance: The register grows with regulatory exposure, not only headcount. These tiers are the library's working tiers, not official definitions. -->

| Aspect | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large: Quillmere Group (2,400 staff, 6 sites) |
|---|---|---|---|
| Typical entries *(Example)* | 10: one data protection authority, national CSIRT, police cybercrime unit, cloud provider, identity provider, two advisory feeds, insurer, certification body, one professional chapter | 18: the 10 above plus the health sector ISAC, a regional forum, the colocation provider, a forensics retainer and security contacts of 4 key hospital customers | 45 or more: authorities per country (4 countries), OT vendor PSIRTs for the 3 plants, utility and emergency contacts per site |
| Owner | Head of Engineering Operations (0.5 FTE ISMS manager) | ISMS manager with the privacy lead | CISO office, with a site contact list per site |
| Review | Annual full review; quarterly portal checks | Quarterly incident contacts | Quarterly per site, consolidated centrally |

## 6. Records and evidence

<!-- Guidance: List this register in `isms/control-evidence-matrix` (DOC-ISMS-033) against A.5.5 and A.5.6. -->

| Record | Owner | Location *(Example)* | Retention *(Example)* |
|---|---|---|---|
| This register (all versions) | ISMS manager | ISMS document store | Certification cycle plus 1 year (at least 4 years) |
| Verification log | ISMS manager | Section 4 and tickets | Same as the register |
| Contacts made during incidents | Incident commander | Incident tickets linked from `isms/incident-register` | Same as the incident register |
| Shared intelligence and alerts received | Security operations lead | Threat intelligence records | Per `isms/threat-intelligence-procedure` |

## 7. References

<!-- Guidance: Check sharing rules and authority routes on official sites only. -->

- ISO/IEC 27001:2022 + Amd 1:2024: https://www.iso.org/standard/82875.html
  and https://www.iso.org/standard/88435.html
- ISO/IEC 27002:2022: https://www.iso.org/standard/75652.html
- ISO/IEC 27035-1:2023: https://www.iso.org/standard/78973.html
- FIRST Traffic Light Protocol (TLP) version 2.0, authoritative from
  August 2022
- RFC 9116, A File Format to Aid in Security Vulnerability Disclosure
  (security.txt), April 2022
- Related templates: `compliance/incident-response-plan` (DOC-ISMS-020),
  `isms/incident-register` (DOC-ISMS-021),
  `isms/threat-intelligence-procedure` (DOC-ISMS-045),
  `compliance/legal-register` (DOC-ISMS-014),
  `isms/crisis-management-communications-plan` (DOC-ISMS-078),
  `security/tabletop-exercise`, `isms/control-evidence-matrix`
  (DOC-ISMS-033)

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (Annex A controls
A.5.5 and A.5.6) and ISO/IEC 27002:2022. Control numbers are cited with
original short labels only; no ISO or IEC text is reproduced, and you
need the official standards to implement and audit the controls. The
register structure, rules and examples are original; no real contact
details are given. Check the current editions before use.

Template licence: MIT.