Operational planning and control

What the baseline asks

Plan, carry out and control the processes needed to satisfy BCMS requirements and to take the actions decided on for risks and opportunities, by setting criteria for the processes, controlling them against those criteria and keeping enough documented information to be sure they were carried out as planned. Control planned changes, look at what unplanned changes have led to and act to limit any harm, and make sure that processes done by others and the supply chain are kept under control.

What it means when the service runs in the cloud

Operational planning turns the strategy into runbooks a tired person can follow at two in the morning. For cloud services that means the console, the credentials, the export path and the order of restoration.

Evidence an auditor or a customer asks for

• Documented process criteria for BCMS operational processes
• Records showing processes ran to those criteria
• Change records covering planned changes and reviews of unintended change
• Evidence of control over outsourced processes and the supply chain

Common gaps in a cloud estate

• Supply chain control asserted through contract clauses with no verification behind them
• Criteria absent, so control of a process cannot be demonstrated
• Unintended changes never reviewed because nothing detects them
• Outsourced processes treated as the provider's problem

Done well, what the file shows

Done well, this clause leaves a documented process criteria for bcms operational processes that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Walk one critical service runbook and note every step that needs a provider console.