Business continuity management system

What the baseline asks

Set up a business continuity management system, put it into effect, keep it running and keep improving it, including the processes it needs and how they interact, as the standard requires.

What it means when the service runs in the cloud

One continuity system has to cover capability you own and capability you rent, with the same objectives and the same review. Splitting the cloud estate into a separate informal process is how provider incidents end up outside the management review.

Evidence an auditor or a customer asks for

• BCMS manual or equivalent showing the constituent processes and their interactions
• Process owners named for each BCMS process
• Evidence of operation across a full cycle rather than at implementation only

Common gaps in a cloud estate

• A documented system that exists on paper with no evidence any process actually ran
• Process interactions undocumented, so handoffs between impact analysis, strategy and planning are invisible
• Continual improvement asserted but not evidenced anywhere in the BCMS

Done well, what the file shows

Done well, this clause leaves a bcms manual or equivalent showing the constituent processes and their interactions that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Confirm the cloud services appear in the same continuity system, objectives and audit cycle as owned systems.