Awareness

What the baseline asks

Everyone working under the organization's direction must know the business continuity policy, how they add to the effectiveness of the BCMS and what improved continuity performance brings, what follows from failing to conform, and what their own part and duties are ahead of, during and following a disruption.

What it means when the service runs in the cloud

Awareness means the service owners know which of their systems depend on which provider, and what to do first when that provider reports a problem. Most cloud incidents are first noticed by a customer, not by the provider's status page.

Evidence an auditor or a customer asks for

• Awareness material covering all four required points
• Delivery records covering staff, contractors and new starters
• A test of awareness, such as a spot check or survey, rather than delivery evidence alone

Common gaps in a cloud estate

• Awareness content covering the policy only, silent on individual roles during a disruption
• Contractors and temporary staff excluded despite working under the organization's control
• No verification, so awareness is evidenced by attendance rather than by knowledge

Done well, what the file shows

Done well, this clause leaves a awareness material covering all four required points that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Ask two service owners to name their provider dependency and first action from memory.