Operation
8.6
Evaluation of business continuity documentation and capabilities
Evaluate whether the impact analysis, the risk assessment, the strategies, the solutions, the plans and the procedures are still suitable, adequate and effective. Do this through reviews, analysis, exercises, tests, reports after incidents and performance evaluations; evaluate the continuity capabilities of the partners and suppliers that matter; evaluate whether applicable laws, regulations and industry practice are complied with, and whether the organization's own policy and objectives are met; and update documentation and procedures without delay. Carry out these evaluations at planned intervals, after any incident or activation, and whenever significant change happens.
What the baseline asks
Evaluate whether the impact analysis, the risk assessment, the strategies, the solutions, the plans and the procedures are still suitable, adequate and effective. Do this through reviews, analysis, exercises, tests, reports after incidents and performance evaluations; evaluate the continuity capabilities of the partners and suppliers that matter; evaluate whether applicable laws, regulations and industry practice are complied with, and whether the organization's own policy and objectives are met; and update documentation and procedures without delay. Carry out these evaluations at planned intervals, after any incident or activation, and whenever significant change happens.
What it means when the service runs in the cloud
Evaluating documentation and capability means checking that the plan still matches the estate. Cloud estates drift faster than most, so compare the plan with the current service inventory before the next review.
Evidence an auditor or a customer asks for
- Evaluation records covering each element of the BCMS documentation set
- Partner and supplier continuity capability assessments with evidence behind them
- Compliance and conformity evaluation results
- Post incident and post activation evaluations
- Documentation update records traceable to evaluation findings
Common gaps in a cloud estate
- Supplier continuity accepted on a self assessment questionnaire with nothing verified
- Evaluation performed only on the anniversary, never after an actual activation
- Findings raised but documentation not updated, so the next responder uses the superseded version
- Legal and regulatory compliance evaluation omitted from the continuity evaluation entirely
Done well, what the file shows
Done well, this clause leaves a evaluation records covering each element of the bcms documentation set that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Compare the plan's service list with the current inventory and count the differences.