Preparation register
The continuity requirements a cloud customer is measured on
57 clauses of the held continuity baseline, each stated in our own words, cited to its clause, and given a test that applies when the service runs in somebody else's cloud. This is the system the ISO/IEC DIS 20996 guidance builds on. It is not the DIS text, which is not public.
57 clauses7 parts0 placeholders
Read it in order
Context of the organization 8
| Clause | Requirement | Topic |
|---|---|---|
| 4.1 | Understanding the organization and its context | Context analysis |
| 4.2 | Understanding the needs and expectations of interested parties | Interested parties |
| 4.2.1 | General | Interested parties |
| 4.2.2 | Legal and regulatory requirements | Legal and regulatory obligations |
| 4.3 | Determining the scope of the business continuity management system | BCMS scope |
| 4.3.1 | General | BCMS scope |
| 4.3.2 | Scope of the business continuity management system | BCMS scope |
| 4.4 | Business continuity management system | BCMS establishment |
Leadership 5
| Clause | Requirement | Topic |
|---|---|---|
| 5.1 | Leadership and commitment | Leadership |
| 5.2 | Policy | Policy |
| 5.2.1 | Establishing the business continuity policy | Policy |
| 5.2.2 | Communicating the business continuity policy | Policy |
| 5.3 | Roles, responsibilities and authorities | Leadership |
Planning 7
| Clause | Requirement | Topic |
|---|---|---|
| 6.1 | Actions to address risks and opportunities | Management system risk |
| 6.1.1 | Determining risks and opportunities | Management system risk |
| 6.1.2 | Addressing risks and opportunities | Management system risk |
| 6.2 | Business continuity objectives and planning to achieve them | Objectives |
| 6.2.1 | Establishing business continuity objectives | Objectives |
| 6.2.2 | Determining business continuity objectives | Objectives |
| 6.3 | Planning changes to the business continuity management system | Change management |
Support 8
| Clause | Requirement | Topic |
|---|---|---|
| 7.1 | Resources | Resourcing |
| 7.2 | Competence | Competence |
| 7.3 | Awareness | Awareness |
| 7.4 | Communication | Communication |
| 7.5 | Documented information | Documented information |
| 7.5.1 | General | Documented information |
| 7.5.2 | Creating and updating | Document control |
| 7.5.3 | Control of documented information | Document control |
Operation 19
| Clause | Requirement | Topic |
|---|---|---|
| 8.1 | Operational planning and control | Operational control |
| 8.2 | Business impact analysis and risk assessment | Business impact analysis |
| 8.2.1 | General | Business impact analysis |
| 8.2.2 | Business impact analysis | Business impact analysis |
| 8.2.3 | Risk assessment | Risk assessment |
| 8.3 | Business continuity strategies and solutions | Continuity strategy |
| 8.3.1 | General | Continuity strategy |
| 8.3.2 | Identification of strategies and solutions | Continuity strategy |
| 8.3.3 | Selection of strategies and solutions | Continuity strategy |
| 8.3.4 | Resource requirements | Resourcing |
| 8.3.5 | Implementation of solutions | Solution implementation |
| 8.4 | Business continuity plans and procedures | Response planning |
| 8.4.1 | General | Response planning |
| 8.4.2 | Response structure | Response structure |
| 8.4.3 | Warning and communication | Crisis communication |
| 8.4.4 | Business continuity plans | Business continuity plans |
| 8.4.5 | Recovery | Recovery |
| 8.5 | Exercise programme | Exercising |
| 8.6 | Evaluation of business continuity documentation and capabilities | Capability evaluation |
Performance evaluation 8
| Clause | Requirement | Topic |
|---|---|---|
| 9.1 | Monitoring, measurement, analysis and evaluation | Performance measurement |
| 9.2 | Internal audit | Internal audit |
| 9.2.1 | General | Internal audit |
| 9.2.2 | Audit programme(s) | Internal audit |
| 9.3 | Management review | Management review |
| 9.3.1 | General | Management review |
| 9.3.2 | Management review input | Management review |
| 9.3.3 | Management review outputs | Management review |
Improvement 2
| Clause | Requirement | Topic |
|---|---|---|
| 10.1 | Nonconformity and corrective action | Nonconformity |
| 10.2 | Continual improvement | Continual improvement |
The rules this is built from
Every requirement on this site is written from a held rule and points to the clause it came from. Nothing is invented while you wait.
- Read from the real rules, not invented
- 57 official requirements behind it
- Cross-checked against 7 continuity and resilience frameworks
- Check any line yourself
How the record is made and where each source comes from. The continuity baseline is ISO 22301:2019, read here.
What this register is, and is not
It is the continuity management baseline, clause by clause, read from the held framework and preflighted for placeholders, shared evidence and named bodies before any page was written. It is not the ISO/IEC DIS 20996 clause list. ISO has not published that list, and this site does not invent it.
Where the guidance adds a cloud-specific expectation, it will be added here with its citation. The change log records each addition.