Planning
6.3
Planning changes to the business continuity management system
Where the BCMS has to change, including changes prompted by nonconformity or improvement, make the change in a planned way, weighing why it is being made and what it could lead to, whether the BCMS stays intact, whether enough resources are available, and how responsibilities and authorities are assigned or moved.
What the baseline asks
Where the BCMS has to change, including changes prompted by nonconformity or improvement, make the change in a planned way, weighing why it is being made and what it could lead to, whether the BCMS stays intact, whether enough resources are available, and how responsibilities and authorities are assigned or moved.
What it means when the service runs in the cloud
A region change, a platform migration or a new provider is a change to the continuity system, not only to the architecture. Treat it as a planned change with an impact review, because the old fallback may stop working the day the migration completes.
Evidence an auditor or a customer asks for
- Change records for BCMS changes showing purpose and consequence analysis
- Assessment of the effect on BCMS integrity
- Resource and accountability reallocation recorded with the change
Common gaps in a cloud estate
- BCMS changes made informally, visible only as an unexplained document version bump
- Consequence analysis skipped for changes that originated as corrective actions
- Responsibilities left with departed staff after a reorganisation
Done well, what the file shows
Done well, this clause leaves a change records for bcms changes showing purpose and consequence analysis that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Check that provider and region changes go through the continuity change process.