Leadership
5.2
Policy
Maintain a business continuity policy that top management has set and that reaches the people inside the organization and the interested parties outside it who need to see it.
What the baseline asks
Maintain a business continuity policy that top management has set and that reaches the people inside the organization and the interested parties outside it who need to see it.
What it means when the service runs in the cloud
A continuity policy written for data centres often says nothing about rented infrastructure. The policy should say plainly that provider dependence is in scope and that contracts, exit plans and restore tests are part of the control set.
Evidence an auditor or a customer asks for
- Current approved business continuity policy
- Distribution and communication records
- Evidence the policy is obtainable by interested parties where appropriate
Common gaps in a cloud estate
- Policy approved once and left unreviewed through several reorganisations
- Policy published on an intranet nobody is directed to
- No decision recorded about which interested parties should receive it
Done well, what the file shows
Done well, this clause leaves a current approved business continuity policy that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Check the policy mentions cloud services and the provider relationship explicitly.