[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-5":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-5","Annex A 5.5","Contact with authorities",0,"International Organization for Standardization (ISO) and IEC","**What it asks for.** The organisation should establish and maintain contact with relevant authorities. It should know who to contact, when, and how.\n\n**In practice.** A current list identifies regulators, data protection authorities, national CSIRTs or competent authorities under laws such as NIS2, law enforcement and emergency services, with contact details and the circumstances for contacting each. Responsibility for the contacts is assigned, and incident procedures reference them, including any legal reporting deadlines. Evidence includes the contact list, review dates and records of past notifications or exchanges.\n\n**Common gaps.** Contact lists go out of date, especially after regulatory changes that introduce new authorities. Organisations often discover during an incident that nobody knows who should notify which regulator or within what time.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]