# Clause 5.2: Policy

Maintain a business continuity policy that top management has set and that reaches the people inside the organization and the interested parties outside it who need to see it.

Cloud: A continuity policy written for data centres often says nothing about rented infrastructure. The policy should say plainly that provider dependence is in scope and that contracts, exit plans and restore tests are part of the control set.

Evidence: Current approved business continuity policy; Distribution and communication records; Evidence the policy is obtainable by interested parties where appropriate.

Test: Check the policy mentions cloud services and the provider relationship explicitly.

Citation: ISO 22301:2019, clause 5.2. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.