Communication

What the baseline asks

Determine the internal and external communications the BCMS requires, settling what will be communicated, when, with whom, how, and by whom.

What it means when the service runs in the cloud

Communication in a provider incident has an extra leg: the provider's escalation channel. Record how you reach them, what they will tell you and when, and what you tell customers while you wait.

Evidence an auditor or a customer asks for

• Communication plan addressing each of the five determinations
• Named communicators with authority to speak externally
• Evidence the plan has been used, not merely written

Common gaps in a cloud estate

• Plan covers what and when but never says who is authorised to communicate
• External communication deferred entirely to corporate affairs with no continuity input
• Plan untested, so channel assumptions fail on first use

Done well, what the file shows

Done well, this clause leaves a communication plan addressing each of the five determinations that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Check the plan records a provider escalation route that has been used in a test.