Determining risks and opportunities

What the baseline asks

Taking the context issues and interested party requirements already identified, determine which risks and opportunities must be addressed so the BCMS achieves its intended outcomes, prevents or reduces undesired effects, and continues to improve.

What it means when the service runs in the cloud

Determining the risks means asking what would have to fail for a critical activity to stop, and how much of that failure sits outside your control. A single provider carrying two critical services is a different risk from two providers carrying one each.

Evidence an auditor or a customer asks for

• Risk and opportunity register traceable to specific context issues and party requirements
• Statement of the intended BCMS outcomes the register is judged against
• Review record showing the register is maintained

Common gaps in a cloud estate

• Register produced independently of the context analysis, so the two never agree
• Only threats recorded, with continual improvement opportunities absent
• No stated BCMS outcome, so nothing anchors what counts as a risk

Done well, what the file shows

Done well, this clause leaves a risk and opportunity register traceable to specific context issues and party requirements that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Map each critical activity to the providers and regions it needs, then look for shared failure points.