Introduction

When a cyber incident occurs, time is everything. Waiting until you’re under attack to figure out who to call at the regulatory body, law enforcement, or privacy commissioner could cost your organization dearly.

ISO 27001 Control 5.5 emphasizes the importance of establishing and maintaining contact with relevant authorities before you need them.

Summary of Control 5.5: Contact with Authorities

🔒 Control Title: Contact with Authorities
📘 Source: ISO/IEC 27002:2022, Section 5.5
🧩 Control Category: Organizational
🔍 Attributes:

• Control Type: #Corrective
• Security Properties: #Confidentiality, #Integrity, #Availability
• Cybersecurity Concepts: #Respond, #Recover
• Operational Capabilities: #Incident_Response
• Security Domain: #Protection_and_Defense, #Governance_and_Ecosystem

Control Objective

To ensure your organization can quickly and effectively communicate with relevant authorities (law enforcement, regulators, industry bodies) as part of its incident response, compliance, or legal obligations.

Implementation Guidance

1) Identify Relevant Authorities:

• Examples include:
  • Local and national law enforcement
  • Privacy commissioners (e.g. OPC in Canada)
  • Cybercrime units
  • Sector-specific regulators (e.g. financial, healthcare, critical infrastructure)

2) Maintain Up-to-Date Contact Information:

• Keep an internal registry of authority contacts
• Include name, department, phone, email, role, and jurisdiction

3) Assign Responsibility:

• Designate a team or role (e.g. CISO, privacy officer) to manage these relationships

4) Document Procedures:

• Define when, how, and who should initiate contact (e.g., data breach, ransomware, compliance inquiries)

5) Establish Relationships Early:

• Consider introducing your organization to authorities before incidents happen

Why This Control Matters

Delayed or improper communication with authorities can lead to:

• Legal penalties
• Escalated damage during incidents
• Loss of trust and credibility

This control supports not only legal compliance but also strengthens your incident response capabilities and cooperation with external parties.

Common Pitfalls to Avoid

• Not knowing who your relevant authorities are
• Contact details that are outdated or inaccessible during a crisis
• No clear policy on when to escalate an issue externally
• Assigning responsibility but not providing training or documentation

Canadian Cyber’s Take

At Canadian Cyber, we help organizations in Canada and beyond build structured relationships with the authorities that matter. From privacy regulators to law enforcement, we ensure you’re connected, compliant, and ready to respond.

Want to Build the Right Channels Before a Breach?

We’ll help you create a contact framework aligned with ISO 27001 and your industry’s regulatory requirements.
👉 Click here to connect with our experts.

• Share the blog on: