# Clause 5.2.2: Communicating the business continuity policy

Hold the business continuity policy as documented information, communicate it within the organization, and make it available to interested parties where that is appropriate.

Cloud: The people who need the policy most are the ones who talk to the provider: procurement, service owners, security and the incident desk. Communicate it where they work, not only in a document library.

Evidence: Controlled copy of the policy with version and date; Records of communication to staff, including new starters; Evidence of external availability where appropriate, and the decision on which parties get it.

Test: Confirm the provider-facing teams can state the continuity commitments they are expected to enforce.

Citation: ISO 22301:2019, clause 5.2.2. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.