Operation
8.2.1
General
Put in place and keep up systematic processes both for analysing what a disruption would do to the business and for assessing the risk of disruption, and review what both produce at planned intervals and whenever the organization, or the setting it works in, changes significantly.
What the baseline asks
Put in place and keep up systematic processes both for analysing what a disruption would do to the business and for assessing the risk of disruption, and review what both produce at planned intervals and whenever the organization, or the setting it works in, changes significantly.
What it means when the service runs in the cloud
Keep the analysis method consistent across owned and rented systems so the results can be compared. A provider service that scores lower only because the analysis was thinner is a hidden risk.
Evidence an auditor or a customer asks for
- Written method for each process showing it is systematic and repeatable
- Planned review interval with evidence reviews occurred
- Change triggered reviews evidenced against actual organizational changes
Common gaps in a cloud estate
- Method exists as a spreadsheet convention rather than a documented process
- Planned interval set at annual and then missed without escalation
- Significant change defined nowhere, so the change trigger never fires
Done well, what the file shows
Done well, this clause leaves a written method for each process showing it is systematic and repeatable that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Check the same impact scale is applied to owned and cloud-hosted activities.