Control 5.30 asks you to make sure your IT and communication technology can withstand disruption, so required data and assets are available when needed. You plan readiness, implement it, maintain it and test it. It is new in the 2022 edition of ISO 27001.
What it expects
Four verbs: plan, implement, maintain, test. Recovery speed should be based on your risk assessment, which in turn should reflect what the business needs. The guidance mentions recovery time objectives in the context of training staff to recover within them, but does not define the term or say how to set values beyond basing speed on risk.
Start from the business
List the services you must keep running, then ask how long each can be down and how much data loss is tolerable. Those two answers drive your design. A customer facing API and an internal wiki have different answers.
Technology, process, people
- Technology: resilience and redundancy for software, hardware, networks and external communication links, based on risk and recovery speed needs.
- Process: planning, maintaining and recovering IT infrastructure, and testing recovery plans.
- People: awareness of why readiness matters, and training on carrying out the recovery plans.
Testing
You need a process for testing disaster recovery or continuity plans. The guidance specifies no frequency or method. Choose something real, such as restoring a backup into a clean environment and timing it, and record the result. An untested backup is an assumption.
Documents
Recommended, not mandatory: a disaster recovery plan for smaller companies, or a business continuity strategy for mid sized and larger ones.
What the auditor looks for
Evidence that your ICT is ready for disruption. Missing evidence is treated as a nonconformity. Prepare:
- The list of critical services with recovery targets.
- Architecture notes showing redundancy where you claim it.
- The latest recovery test record, with timings and issues found.
- Corrective actions raised from the test.
Link to other controls
This control sits beside control 5.29 on information security during disruption. Your plan should cover how security is kept in place while you recover, such as access control on emergency accounts.
A simple yearly pattern
- Review services and targets.
- Run one restore test and one tabletop exercise.
- Record gaps as corrective actions.
- Report results at the management review.
What a short plan can contain
For a small team, a two page plan is enough: the critical services and their recovery targets, where backups live, who makes the call to start recovery, the order of restoration, and how customers are told. Keep contact details current and store a copy outside the systems it describes, so you can reach it when those systems are down.
Quick check
How often must recovery be tested?
The control gives no frequency. Pick one that matches your risk, write it down and keep to it.
Do we need our own disaster recovery plan if we use a cloud provider?
The provider's resilience helps, but you remain responsible for your data, configuration and recovery steps. A short plan that covers those is expected.
Sources
Last reviewed: 19 October 2026.
