Addressing risks and opportunities

What the baseline asks

Plan the actions that will address those risks and opportunities, and plan how each action will be integrated into and implemented within BCMS processes and how its effectiveness will subsequently be evaluated.

What it means when the service runs in the cloud

Treatment for provider risk is usually contractual, architectural or procedural, and each has a cost. Record which treatment was chosen, what it reduces and what it leaves exposed, so the board is deciding with the same facts later.

Evidence an auditor or a customer asks for

• Action plan naming owner, target date and the BCMS process the action lands in
• Updated BCMS procedures, plans or BIA records showing where each planned action was built in
• Effectiveness evaluation carried out through performance evaluation

Common gaps in a cloud estate

• Actions closed on completion with no evaluation of whether they worked
• Actions held in a standalone tracker that never touches a BCMS process
• No effectiveness criterion set, so evaluation has nothing to test against

Done well, what the file shows

Done well, this clause leaves a action plan naming owner, target date and the bcms process the action lands in that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

For each treatment, state the risk it reduces and the exposure that remains.