Response structure

What the baseline asks

Put in place and keep up a structure of one or more teams that respond to disruptions, with clearly stated roles and responsibilities and clear relationships between teams. Between them the teams must be able to: judge a disruption and its impact against thresholds set beforehand that warrant a formal response; trigger the response and the continuity solutions; plan actions; set priorities, putting the safety of life first; monitor the disruption and the response; and communicate with interested parties, the authorities and the media. Every team must have named people, with stand-ins, who hold the responsibility, authority and competence required, and documented procedures for triggering, running, coordinating and communicating.

What it means when the service runs in the cloud

The response structure has to say who speaks to the provider, who decides to invoke the fallback, and who tells customers. In practice the provider's account team will be talking to several of your people at once unless one is named.

Evidence an auditor or a customer asks for

• Team structure chart with roles, responsibilities and inter team relationships
• Pre defined activation thresholds and the authority to invoke them
• Named team members and alternates with competence evidence
• Documented team procedures for activation, operation, coordination and communication
• Exercise evidence that the teams performed the listed competences

Common gaps in a cloud estate

• Alternates named on paper but never included in an exercise
• Activation thresholds undefined, so invocation waits on consensus
• Life safety priority stated in policy but absent from the team procedures
• Media and authority communication left to a role with no delegated authority to speak

Done well, what the file shows

Done well, this clause leaves a team structure chart with roles, responsibilities and inter team relationships that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Confirm one named role owns the provider conversation during an incident.