Why it matters
Security controls are often the first thing quietly dropped during a crisis — this control exists to stop that.
How a self-led small team implements it
State explicitly in your continuity plan which security controls must stay in place even during an outage or disruption.
What auditors expect to see
Business continuity plan referencing security requirements.
Track A.5.29 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS