Understanding the organization and its context

What the baseline asks

Identify the external and internal issues bearing on the organization's purpose that could stop its business continuity management system from delivering the outcomes it is meant to deliver, having regard to its objectives, what it provides, and how much risk, and of what kinds, it is prepared to carry.

What it means when the service runs in the cloud

A cloud customer's context is no longer only its own estate. It includes the services it rents, the regions those run in, the providers and subproviders underneath them, and the customers who depend on the outcome. Write the dependency down before the guidance lands, because the first question an auditor will ask is which of your critical activities sit on somebody else's platform.

Evidence an auditor or a customer asks for

• Documented context analysis naming external and internal issues
• Link from each issue to the BCMS outcome it threatens
• Evidence the analysis was reviewed when the organization or its market changed
• Statement of the risk appetite the analysis was judged against

Common gaps in a cloud estate

• Context recorded once at certification and never revisited after reorganisation, acquisition or a change of product mix
• Issues listed generically (economic conditions, cyber threat) with no traceable effect on a BCMS outcome
• Internal issues omitted entirely, so the analysis reads as an external threat scan

Done well, what the file shows

Done well, this clause leaves a documented context analysis naming external and internal issues that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

List every cloud service that carries a critical activity, with its provider, region and business owner.