General

What the baseline asks

The BCMS must include both the documented information the standard requires and whatever further documented information the organization itself judges necessary for the BCMS to be effective.

What it means when the service runs in the cloud

Documented information for cloud continuity includes material you do not author: contracts, service descriptions, audit reports and status history. Keep it where it can be found during an incident, not only in procurement's archive.

Evidence an auditor or a customer asks for

• Mapping from each documentation requirement of the standard to the document that satisfies it
• Rationale for additional documentation the organization chose to hold
• Evidence the set is proportionate to the size and complexity of the organization

Common gaps in a cloud estate

• Documentation assembled to a template with no mapping back to requirements
• Organization specific documentation absent, leaving gaps the standard does not name explicitly
• Volume mistaken for effectiveness, with documents nobody uses

Done well, what the file shows

Done well, this clause leaves a mapping from each documentation requirement of the standard to the document that satisfies it that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Confirm the incident team can open the current contract and service description without asking procurement.