Operation
8.2
Business impact analysis and risk assessment
Run and maintain the processes that establish what disruption would cost the organization over time and what could cause it, and refresh both whenever the organization or its operating context changes significantly.
What the baseline asks
Run and maintain the processes that establish what disruption would cost the organization over time and what could cause it, and refresh both whenever the organization or its operating context changes significantly.
What it means when the service runs in the cloud
The analysis has to treat a provider outage as a scenario in its own right, alongside the loss of your own site. The two have different warning signs, different recovery paths and different evidence.
Evidence an auditor or a customer asks for
- Documented BIA and risk assessment processes
- Current outputs of both
- Review triggers and evidence of review after significant change
Common gaps in a cloud estate
- Both performed once at implementation and treated as permanent
- No defined trigger for refresh, so significant change passes unnoticed
- Risk assessment run without reference to the BIA outputs it should be scoped by
Done well, what the file shows
Done well, this clause leaves a documented bia and risk assessment processes that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Confirm a provider outage scenario is analysed separately from a site loss.