General

What the baseline asks

When setting up the BCMS, identify which interested parties matter to it and record the requirements each of them has.

What it means when the service runs in the cloud

Keep the view general enough to cover new services and specific enough to be useful during an incident. A list that only names the provider misses the subproviders and the regions that decide whether a failure is survivable.

Evidence an auditor or a customer asks for

• Interested party register, dated and owned
• The specific requirement captured for each listed party
• Method note showing how relevance to the BCMS was decided

Common gaps in a cloud estate

• Relevance never argued, so the register is either everyone or only customers
• Requirements captured as categories rather than as something testable
• Register not revisited when new contracts or dependencies are taken on

Done well, what the file shows

Done well, this clause leaves a interested party register, dated and owned that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Check that the list is reviewed when a service is added, moved or retired.