# Clause 8.2.1: General

Put in place and keep up systematic processes both for analysing what a disruption would do to the business and for assessing the risk of disruption, and review what both produce at planned intervals and whenever the organization, or the setting it works in, changes significantly.

Cloud: Keep the analysis method consistent across owned and rented systems so the results can be compared. A provider service that scores lower only because the analysis was thinner is a hidden risk.

Evidence: Written method for each process showing it is systematic and repeatable; Planned review interval with evidence reviews occurred; Change triggered reviews evidenced against actual organizational changes.

Test: Check the same impact scale is applied to owned and cloud-hosted activities.

Citation: ISO 22301:2019, clause 8.2.1. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.