Leadership
5.2.2
Communicating the business continuity policy
Hold the business continuity policy as documented information, communicate it within the organization, and make it available to interested parties where that is appropriate.
What the baseline asks
Hold the business continuity policy as documented information, communicate it within the organization, and make it available to interested parties where that is appropriate.
What it means when the service runs in the cloud
The people who need the policy most are the ones who talk to the provider: procurement, service owners, security and the incident desk. Communicate it where they work, not only in a document library.
Evidence an auditor or a customer asks for
- Controlled copy of the policy with version and date
- Records of communication to staff, including new starters
- Evidence of external availability where appropriate, and the decision on which parties get it
Common gaps in a cloud estate
- Policy communicated at launch and never to anyone hired since
- External availability neither provided nor consciously declined
- Uncontrolled copies in circulation alongside the current one
Done well, what the file shows
Done well, this clause leaves a controlled copy of the policy with version and date that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Confirm the provider-facing teams can state the continuity commitments they are expected to enforce.