Support
7.5
Documented information
Hold the documented information the BCMS depends on, create and update it to a defined standard, and control it throughout its life.
What the baseline asks
Hold the documented information the BCMS depends on, create and update it to a defined standard, and control it throughout its life.
What it means when the service runs in the cloud
Provider evidence ages quickly. Attestations, test reports and contract schedules all have versions, and an auditor will ask which version supported the decision you made.
Evidence an auditor or a customer asks for
- Document register covering BCMS documentation
- Defined creation, update and approval route
- Access, retention and disposition rules in force
Common gaps in a cloud estate
- Register incomplete, so documents exist that nothing controls
- External origin documents excluded from control
- Retention rules stated but never applied
Done well, what the file shows
Done well, this clause leaves a document register covering bcms documentation that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
List the provider documents you rely on, with version and retrieval date.