Scope of the business continuity management system

What the baseline asks

State which parts of the organization are inside the BCMS having regard to location, size, nature and complexity, identify the products and services covered, and document and explain every exclusion so that no exclusion undercuts the organization's ability or responsibility to deliver continuity as established by the business impact analysis, the risk assessment and applicable law.

What it means when the service runs in the cloud

A defensible scope names the business activities, the cloud services that support them, the locations involved and the interfaces to anything excluded. Exclusions need a reason, because an excluded backup region is exactly where an incident will go next.

Evidence an auditor or a customer asks for

• List of in scope sites, entities and functions
• List of in scope products and services
• Exclusion log with the explanation for each exclusion
• Cross check that no exclusion contradicts the business impact analysis or a legal obligation

Common gaps in a cloud estate

• Exclusions recorded with no explanation, or explained only as out of scope
• A site or entity excluded that the business impact analysis shows supports a prioritized activity
• Products and services described at brand level so the actual delivery chain is untested

Done well, what the file shows

Done well, this clause leaves a list of in scope sites, entities and functions that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Check that every exclusion carries a reason and a named owner.