# Clause 8.4.3: Warning and communication

Document and keep up procedures for: communicating with relevant interested parties inside and outside the organization, covering what is said, when, to whom and how; receiving, recording and answering communications, including those from national or regional risk advisory systems; keeping the means of communication available while a disruption lasts; structured communication with emergency responders; the organization's media response and communications strategy; and recording the disruption, what was done and which decisions were taken. Where relevant, also warn parties who may be affected by a disruption that is happening or imminent, and make sure several responding organizations work together; exercise these procedures as part of the exercise programme.

Cloud: Warning comes from the provider's status feed, your own monitoring and your customers, often in that order of unreliability. Build a warning path that does not depend on the provider's portal being up.

Evidence: Communication procedures covering internal, external, responder and media routes; Verified alternate communication means that survive loss of primary systems; Incident log template and completed logs from exercises or real events; Contact data with evidence it is maintained; Exercise records covering the warning and communication procedures specifically.

Test: Check monitoring can detect a provider failure without the provider's own status page.

Citation: ISO 22301:2019, clause 8.4.3. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.