Context of the organization
4.3
Determining the scope of the business continuity management system
Fix and document the boundaries of the BCMS, deciding which parts of the organization and which products and services fall inside it and justifying whatever is left outside.
What the baseline asks
Fix and document the boundaries of the BCMS, deciding which parts of the organization and which products and services fall inside it and justifying whatever is left outside.
What it means when the service runs in the cloud
The scope of the continuity system decides whether a cloud outage is inside or outside your plan. If the provider is named but its service and region are not, the plan will argue about coverage on the day it is needed.
Evidence an auditor or a customer asks for
- Approved scope statement held as documented information
- Rationale for the boundary drawn
- Documented exclusions with justification
Common gaps in a cloud estate
- Scope written to fit the audit rather than the business, excluding the activities most likely to fail
- Scope statement with no version or approval trail
- Boundary silent on outsourced or shared service functions
Done well, what the file shows
Done well, this clause leaves a approved scope statement held as documented information that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Read the scope statement and ask whether a provider outage in the named region is inside it.