Roles, responsibilities and authorities

What the baseline asks

Top management must assign and communicate the responsibilities and authorities for the roles the BCMS depends on, and must specifically assign responsibility and authority for ensuring the BCMS conforms to the standard and for reporting BCMS performance back to top management.

What it means when the service runs in the cloud

Provider incidents fail on the handover between teams. Assign one role that owns the relationship during an incident, one that owns the technical recovery, and one that owns the customer message, and write the names into the plan.

Evidence an auditor or a customer asks for

• Role descriptions or a responsibility matrix covering BCMS roles
• Named individual accountable for BCMS conformity
• Named reporting line and evidence of performance reporting to top management
• Evidence the assignments were communicated

Common gaps in a cloud estate

• Roles assigned in a matrix that the holders have never seen
• Conformity accountability and performance reporting rolled into one unfunded part time role
• Deputies undefined, so the BCMS has a single point of failure in its own governance

Done well, what the file shows

Done well, this clause leaves a role descriptions or a responsibility matrix covering bcms roles that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Check that the escalation path names a role for provider contact, technical recovery and customer communication.