Business continuity plans and procedures

What the baseline asks

Maintain a response structure and a set of plans and procedures that let the organization warn and communicate, respond in a structured way, continue prioritized activities and return to normal operation.

What it means when the service runs in the cloud

Plans for a cloud estate need a scenario for the provider being unavailable but the internet working, and a scenario for the provider being reachable but wrong. Both happen, and they need different first moves.

Evidence an auditor or a customer asks for

• Current plan set covering response structure, warning and communication, plans and recovery
• Evidence the plan set derives from the selected strategies and solutions
• Distribution evidence showing plans are where responders are

Common gaps in a cloud estate

• Plan set that documents response but stops short of return to normal operations
• Plans not derived from the selected solutions, so they assume capability that was never built
• Plans available only in one location or one format

Done well, what the file shows

Done well, this clause leaves a current plan set covering response structure, warning and communication, plans and recovery that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Confirm the plan covers provider unavailable and provider degraded as separate scenarios.