General

What the baseline asks

Put in place and keep up a response structure that allows relevant interested parties to be warned and informed in good time. It needs plans and procedures for steering the organization through a disruption and for triggering the continuity solutions, identified and documented from the strategies and solutions that were selected, and procedures that are specific about the first steps to take, adaptable as internal and external conditions change, centred on the impact of incidents, effective at keeping that impact small, and clear about roles and responsibilities.

What it means when the service runs in the cloud

The general plan requirement is that the response is documented before it is needed. For cloud services, include the provider's escalation path and the customer's own decision points in the same document.

Evidence an auditor or a customer asks for

• Documented response structure
• Procedures stating immediate steps and the roles that take them
• Traceability from selected strategies and solutions to the documented plans
• Evidence procedures accommodate changing conditions rather than a single scenario

Common gaps in a cloud estate

• Procedures written for one rehearsed scenario, brittle against anything else
• Immediate steps missing, so the first hour is left to judgement under pressure
• Roles assigned to job titles that no longer exist
• Plans not traceable to any strategy, so their assumptions are untested

Done well, what the file shows

Done well, this clause leaves a documented response structure that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Check the plan names the provider escalation path beside the internal actions.