Operation
8.4.3
Warning and communication
Document and keep up procedures for: communicating with relevant interested parties inside and outside the organization, covering what is said, when, to whom and how; receiving, recording and answering communications, including those from national or regional risk advisory systems; keeping the means of communication available while a disruption lasts; structured communication with emergency responders; the organization's media response and communications strategy; and recording the disruption, what was done and which decisions were taken. Where relevant, also warn parties who may be affected by a disruption that is happening or imminent, and make sure several responding organizations work together; exercise these procedures as part of the exercise programme.
What the baseline asks
Document and keep up procedures for: communicating with relevant interested parties inside and outside the organization, covering what is said, when, to whom and how; receiving, recording and answering communications, including those from national or regional risk advisory systems; keeping the means of communication available while a disruption lasts; structured communication with emergency responders; the organization's media response and communications strategy; and recording the disruption, what was done and which decisions were taken. Where relevant, also warn parties who may be affected by a disruption that is happening or imminent, and make sure several responding organizations work together; exercise these procedures as part of the exercise programme.
What it means when the service runs in the cloud
Warning comes from the provider's status feed, your own monitoring and your customers, often in that order of unreliability. Build a warning path that does not depend on the provider's portal being up.
Evidence an auditor or a customer asks for
- Communication procedures covering internal, external, responder and media routes
- Verified alternate communication means that survive loss of primary systems
- Incident log template and completed logs from exercises or real events
- Contact data with evidence it is maintained
- Exercise records covering the warning and communication procedures specifically
Common gaps in a cloud estate
- Communication cascade depends on the corporate email and telephony that the disruption removes
- Contact lists stale, with departed staff and superseded numbers
- No decision log kept, so the response cannot be reconstructed or defended afterwards
- Inbound communication ignored, with procedures written for broadcast only
- Media response procedure exists but has never been exercised
Done well, what the file shows
Done well, this clause leaves a communication procedures covering internal, external, responder and media routes that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Check monitoring can detect a provider failure without the provider's own status page.