Understanding the needs and expectations of interested parties

What the baseline asks

Establish who holds a stake in the organization's continuity and what each of them requires of it, covering both stated expectations and the legal and regulatory obligations tied to keeping its products and services going.

What it means when the service runs in the cloud

Your customers, your regulator, your insurer and your own board all have an interest in how you continue to serve them when a provider fails. Cloud contracts rarely satisfy those interests on their own, so the interested-party record has to say what each party expects and where the provider sits in meeting it.

Evidence an auditor or a customer asks for

• Interested party register with the requirement recorded against each party
• Register of applicable continuity related legal and regulatory obligations
• Evidence both registers are maintained rather than one time artefacts

Common gaps in a cloud estate

• A stakeholder list with no requirement recorded against any entry
• Legal obligations treated as a compliance department concern and never connected to continuity planning
• Regulators, customers under contractual continuity terms or emergency services left off the register

Done well, what the file shows

Done well, this clause leaves a interested party register with the requirement recorded against each party that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Name the parties that would ask about a provider outage and the expectation each one holds.