Competence

What the baseline asks

Determine the competence needed by people whose work under the organization's control affects business continuity performance, ensure they hold it on the basis of education, training or experience, take and evaluate action where competence is missing, and retain documented evidence of competence.

What it means when the service runs in the cloud

Competence for cloud continuity is specific: reading a provider's resilience documentation, testing an exit, and knowing which data can leave and how. It is rarely covered by general business continuity training.

Evidence an auditor or a customer asks for

• Competence requirements defined per continuity role
• Training records, qualifications or experience evidence per person
• Gap actions with an evaluation of whether the action closed the gap
• Retained competence records

Common gaps in a cloud estate

• Attendance registers filed as though attendance proved competence
• Competence defined for the continuity team only, ignoring response team members and contractors
• Actions taken to build competence never evaluated for effectiveness

Done well, what the file shows

Done well, this clause leaves a competence requirements defined per continuity role that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Name the people who can run an exit or a restore and the evidence of their practice.