Performance evaluation
9.3.1
General
At planned intervals, top management must review the organization's BCMS to make sure it is still suitable, adequate and effective.
What the baseline asks
At planned intervals, top management must review the organization's BCMS to make sure it is still suitable, adequate and effective.
What it means when the service runs in the cloud
The review needs the cloud picture in one place: dependencies, incidents, test outcomes and contract changes. Without it, each function reports its own fragment and nobody sees the concentration.
Evidence an auditor or a customer asks for
- Review schedule and completed review records at the planned interval
- Attendance list showing top management participation
- Explicit conclusion on continuing suitability, adequacy and effectiveness
Common gaps in a cloud estate
- Interval slips repeatedly without escalation
- Reviews held but reaching no stated conclusion on suitability, adequacy and effectiveness
- Top management represented by a delegate with no decision authority
Done well, what the file shows
Done well, this clause leaves a review schedule and completed review records at the planned interval that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Check the review pack contains a single view of critical provider dependencies.