# Clause 8.6: Evaluation of business continuity documentation and capabilities

Evaluate whether the impact analysis, the risk assessment, the strategies, the solutions, the plans and the procedures are still suitable, adequate and effective. Do this through reviews, analysis, exercises, tests, reports after incidents and performance evaluations; evaluate the continuity capabilities of the partners and suppliers that matter; evaluate whether applicable laws, regulations and industry practice are complied with, and whether the organization's own policy and objectives are met; and update documentation and procedures without delay. Carry out these evaluations at planned intervals, after any incident or activation, and whenever significant change happens.

Cloud: Evaluating documentation and capability means checking that the plan still matches the estate. Cloud estates drift faster than most, so compare the plan with the current service inventory before the next review.

Evidence: Evaluation records covering each element of the BCMS documentation set; Partner and supplier continuity capability assessments with evidence behind them; Compliance and conformity evaluation results; Post incident and post activation evaluations; Documentation update records traceable to evaluation findings.

Test: Compare the plan's service list with the current inventory and count the differences.

Citation: ISO 22301:2019, clause 8.6. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.