Support
7.5.2
Creating and updating
When documented information is created or updated, make sure it is suitably identified and described, is in a suitable format and medium, and is reviewed and approved as fit and adequate.
What the baseline asks
When documented information is created or updated, make sure it is suitably identified and described, is in a suitable format and medium, and is reviewed and approved as fit and adequate.
What it means when the service runs in the cloud
Creating and updating the documents should reflect how fast the estate changes. A plan reviewed annually will be wrong for most of the year if services are added quarterly.
Evidence an auditor or a customer asks for
- Documents carrying title, date, author or reference and version
- Review and approval records showing who approved and when
- Format and media choices suited to how the document is used in a disruption
Common gaps in a cloud estate
- Approval evidenced by a name in a footer with no date or record
- Format unsuited to use, such as plans available only on the systems a disruption takes out
- Updates issued without re-approval
Done well, what the file shows
Done well, this clause leaves a documents carrying title, date, author or reference and version that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Compare the document review date with the date the last service was added.