# Clause 8.4.1: General

Put in place and keep up a response structure that allows relevant interested parties to be warned and informed in good time. It needs plans and procedures for steering the organization through a disruption and for triggering the continuity solutions, identified and documented from the strategies and solutions that were selected, and procedures that are specific about the first steps to take, adaptable as internal and external conditions change, centred on the impact of incidents, effective at keeping that impact small, and clear about roles and responsibilities.

Cloud: The general plan requirement is that the response is documented before it is needed. For cloud services, include the provider's escalation path and the customer's own decision points in the same document.

Evidence: Documented response structure; Procedures stating immediate steps and the roles that take them; Traceability from selected strategies and solutions to the documented plans; Evidence procedures accommodate changing conditions rather than a single scenario.

Test: Check the plan names the provider escalation path beside the internal actions.

Citation: ISO 22301:2019, clause 8.4.1. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.