Resource requirements

What the baseline asks

Determine the resources needed to implement the selected continuity solutions, considering at least people, information and data, physical infrastructure such as buildings, workplaces and facilities with their utilities, equipment and consumables, information and communication technology systems, transport and logistics, finance, and partners and suppliers.

What it means when the service runs in the cloud

Resource requirements include the people who can operate the fallback, not only the infrastructure. A warm standby nobody knows how to switch to is a cold standby with a larger bill.

Evidence an auditor or a customer asks for

• Resource requirement schedule per solution covering each required resource type
• Evidence the resource is available or contracted at the required quantity and time
• Reconciliation between required resources and the dependencies identified in the BIA

Common gaps in a cloud estate

• Resource analysis covering ICT only, with people, finance and logistics unexamined
• Requirements stated without quantity or time to availability
• Partner and supplier resources assumed available with no contractual basis
• Consumables and utilities omitted, so a recovery site cannot actually operate

Done well, what the file shows

Done well, this clause leaves a resource requirement schedule per solution covering each required resource type that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Name the people and the access needed to invoke each strategy.