# Clause 6.1: Actions to address risks and opportunities

Work out what could help or hinder the management system itself and plan what to do about it, keeping this separate from the disruption risks handled under business impact analysis and risk assessment.

Cloud: Provider concentration, region failure, account compromise and sudden contract change are risks the continuity system should treat as first-class. Treating them as procurement issues leaves them out of the risk register and out of the funding cycle.

Evidence: Register of risks and opportunities relating to BCMS effectiveness; Planned actions with owners and integration points into BCMS processes; Evidence that BCMS risk is kept distinct from operational disruption risk.

Test: Confirm cloud dependency risks appear in the continuity risk register with owners and treatment.

Citation: ISO 22301:2019, clause 6.1. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.