Planning
6.2
Business continuity objectives and planning to achieve them
Set business continuity objectives and plan concretely how each of them will be achieved.
What the baseline asks
Set business continuity objectives and plan concretely how each of them will be achieved.
What it means when the service runs in the cloud
Continuity objectives for a cloud estate need to be measurable in the provider's terms: recovery time for a region loss, restore coverage for critical services, and the number of critical dependencies with tested fallbacks.
Evidence an auditor or a customer asks for
- Documented objectives with the plan attached to each
- Evidence objectives are monitored and reported
- Evidence the objective set is updated as the organization changes
Common gaps in a cloud estate
- Objectives stated as aspirations with no plan behind them
- Objectives never measured, so achievement is asserted rather than shown
- Objective set unchanged over years despite material change in the business
Done well, what the file shows
Done well, this clause leaves a documented objectives with the plan attached to each that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Check the objectives can be measured from provider records and your own test results.