Establishing business continuity objectives

What the baseline asks

Establish business continuity objectives at the relevant functions and levels; each must be consistent with the continuity policy, measurable where practicable, informed by applicable requirements, and monitored, communicated and updated as appropriate, with the objectives retained as documented information.

What it means when the service runs in the cloud

Set objectives that survive a provider's own recovery assumptions. If the provider promises a recovery time but your restore depends on a backup you have never exercised, your objective is not yet real.

Evidence an auditor or a customer asks for

• Retained objective register showing function, level, measure and owner
• Evidence of monitoring against each measure
• Communication records for the objectives
• Update history for the objective set

Common gaps in a cloud estate

• Objectives only at corporate level, so no function owns one
• Measurability waived without any judgement recorded on why it was impracticable
• Objectives inconsistent with the policy, most often on recovery ambition

Done well, what the file shows

Done well, this clause leaves a retained objective register showing function, level, measure and owner that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Trace each objective to a test that has actually been run.