Planning
6.2.2
Determining business continuity objectives
For each objective, determine what will be done, what resources it needs, who is responsible, when it will be completed and how the results will be evaluated.
What the baseline asks
For each objective, determine what will be done, what resources it needs, who is responsible, when it will be completed and how the results will be evaluated.
What it means when the service runs in the cloud
When the objectives are determined, separate what the provider guarantees from what you must do to use the guarantee. The gap between the two is where most cloud continuity plans are weakest.
Evidence an auditor or a customer asks for
- Plan per objective covering activity, resource, owner, date and evaluation method
- Evidence the resource named was actually made available
- Evaluation results against the stated method
Common gaps in a cloud estate
- Plans that name an owner and a date and nothing else
- Resource requirement omitted, so the objective competes for unallocated effort
- Evaluation method left undefined until after the deadline passes
Done well, what the file shows
Done well, this clause leaves a plan per objective covering activity, resource, owner, date and evaluation method that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
List the provider guarantees you rely on and the customer actions each one depends on.