Monitoring, measurement, analysis and evaluation

What the baseline asks

Determine what needs monitoring and measuring, the methods that will produce valid results, and when and by whom measurement is performed and when and by whom the results are analysed and evaluated; retain the results as documented evidence and use them to evaluate BCMS performance and effectiveness.

What it means when the service runs in the cloud

Monitoring for continuity includes the provider's performance against its commitments, not only its uptime. Track the incidents, the notices and the recovery times that would matter in an audit.

Evidence an auditor or a customer asks for

• Defined measurement set with method, frequency and responsible person for measurement and for analysis
• Retained measurement results
• Evaluation of BCMS performance and effectiveness drawn from those results
• Justification that the methods produce valid, comparable results

Common gaps in a cloud estate

• Activity counted rather than effectiveness measured, so the metrics cannot show whether the BCMS works
• Measurement performed but never analysed, with results filed unread
• Different methods used across periods, making the trend meaningless
• Analysis responsibility unassigned, so measurement stops at collection

Done well, what the file shows

Done well, this clause leaves a defined measurement set with method, frequency and responsible person for measurement and for analysis that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Show the last twelve months of provider incidents and what each one did to your services.