Leadership
5.2.1
Establishing the business continuity policy
Top management must set a business continuity policy that suits the organization's purpose, gives a frame for setting continuity objectives, and commits the organization to satisfying applicable requirements and to continually improving the BCMS.
What the baseline asks
Top management must set a business continuity policy that suits the organization's purpose, gives a frame for setting continuity objectives, and commits the organization to satisfying applicable requirements and to continually improving the BCMS.
What it means when the service runs in the cloud
When the policy is established, give it the levers that matter with a provider: continuity terms in the contract, a named contact in an incident, and a right to test. A policy without those levers is a statement of hope.
Evidence an auditor or a customer asks for
- Approved policy carrying an explicit commitment to applicable requirements and to improvement
- Approval record naming the top management body and the date
- Traceability from the policy to the continuity objectives set under it
Common gaps in a cloud estate
- Generic policy text lifted from a template that says nothing about this organization's purpose
- Commitments to requirements or improvement missing or implied only
- Objectives set with no reference back to the policy framework
Done well, what the file shows
Done well, this clause leaves a approved policy carrying an explicit commitment to applicable requirements and to improvement that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Map each policy commitment to a contract clause or an internal control that delivers it.