Operation
8.3.5
Implementation of solutions
Implement and maintain the selected business continuity solutions so that they can be activated when they are needed.
What the baseline asks
Implement and maintain the selected business continuity solutions so that they can be activated when they are needed.
What it means when the service runs in the cloud
Implementation is where strategies become configurations: replication, backups, runbooks, access paths and alerting. Each one should have an owner and a test date.
Evidence an auditor or a customer asks for
- Implementation records per selected solution
- Maintenance regime keeping the solution in an activatable state
- Readiness evidence such as a successful activation test or standby verification
Common gaps in a cloud estate
- Solution implemented then left to decay as systems, sites and contracts change around it
- Activation never verified, so readiness is an assumption
- Maintenance responsibility unassigned after the implementation project closed
Done well, what the file shows
Done well, this clause leaves a implementation records per selected solution that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Check each implemented solution has an owner and a scheduled test.