Planning
6.1
Actions to address risks and opportunities
Work out what could help or hinder the management system itself and plan what to do about it, keeping this separate from the disruption risks handled under business impact analysis and risk assessment.
What the baseline asks
Work out what could help or hinder the management system itself and plan what to do about it, keeping this separate from the disruption risks handled under business impact analysis and risk assessment.
What it means when the service runs in the cloud
Provider concentration, region failure, account compromise and sudden contract change are risks the continuity system should treat as first-class. Treating them as procurement issues leaves them out of the risk register and out of the funding cycle.
Evidence an auditor or a customer asks for
- Register of risks and opportunities relating to BCMS effectiveness
- Planned actions with owners and integration points into BCMS processes
- Evidence that BCMS risk is kept distinct from operational disruption risk
Common gaps in a cloud estate
- BCMS risk conflated with disruption risk, so management system weaknesses are never surfaced
- Opportunities omitted entirely, leaving a one sided risk register
- Actions planned but never integrated into a BCMS process or evaluated
Done well, what the file shows
Done well, this clause leaves a register of risks and opportunities relating to bcms effectiveness that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Confirm cloud dependency risks appear in the continuity risk register with owners and treatment.