Leadership
5.1
Leadership and commitment
Top management must personally own the BCMS: aligning the continuity policy and objectives with the strategic direction, integrating BCMS requirements into business processes, making resources available, communicating why effective continuity and conformity matter, holding the BCMS to its intended outcomes, directing and supporting the people who deliver it, promoting continual improvement, and backing other managers to lead continuity in their own areas.
What the baseline asks
Top management must personally own the BCMS: aligning the continuity policy and objectives with the strategic direction, integrating BCMS requirements into business processes, making resources available, communicating why effective continuity and conformity matter, holding the BCMS to its intended outcomes, directing and supporting the people who deliver it, promoting continual improvement, and backing other managers to lead continuity in their own areas.
What it means when the service runs in the cloud
Accountability for continuity does not move to the provider when the workload does. Leadership has to own the decision to accept a provider's resilience claims, fund the fallback, and sign the risk that remains.
Evidence an auditor or a customer asks for
- Minutes showing top management setting or approving continuity policy and objectives
- Evidence of BCMS requirements embedded in business process documentation
- Approved budget or resource allocation traceable to the BCMS
- Internal communications from top management about continuity
- Evidence of managers below top level held accountable for continuity in their areas
Common gaps in a cloud estate
- Commitment evidenced only by a signature on the policy
- Continuity funded from a residual budget with no top management decision behind it
- Continuity treated as a specialist function that no line manager is answerable for
- No link demonstrable between continuity objectives and strategic direction
Done well, what the file shows
Done well, this clause leaves a minutes showing top management setting or approving continuity policy and objectives that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Name the executive who signs the residual risk for each critical cloud dependency.