Performance evaluation
9.3.2
Management review input
The review must take into account: where actions from earlier reviews stand; changes in the internal and external issues that matter to the BCMS; information on BCMS performance, including trends in nonconformities and corrective actions, results of monitoring and measurement, and audit results; feedback from interested parties; whether changes are needed, to policy and objectives among others, and which procedures and resources could lift performance and effectiveness; what the impact analysis and the risk assessment show; the result of evaluating continuity documentation and capabilities; risks or issues that no earlier risk assessment dealt with properly; lessons and actions coming out of disruptions and near misses; and chances for continual improvement.
What the baseline asks
The review must take into account: where actions from earlier reviews stand; changes in the internal and external issues that matter to the BCMS; information on BCMS performance, including trends in nonconformities and corrective actions, results of monitoring and measurement, and audit results; feedback from interested parties; whether changes are needed, to policy and objectives among others, and which procedures and resources could lift performance and effectiveness; what the impact analysis and the risk assessment show; the result of evaluating continuity documentation and capabilities; risks or issues that no earlier risk assessment dealt with properly; lessons and actions coming out of disruptions and near misses; and chances for continual improvement.
What it means when the service runs in the cloud
Inputs should include the provider's own incident history, the results of your restore tests and any change in the provider's ownership or service catalogue. A provider acquisition can change your continuity position overnight.
Evidence an auditor or a customer asks for
- Review pack demonstrably covering every required input
- Trend data rather than point in time figures for nonconformities, measurement and audits
- Near miss and disruption lessons presented with the actions arising
- Interested party feedback captured and presented
- Evidence that previously unaddressed risks were surfaced rather than dropped
Common gaps in a cloud estate
- Input pack covering audit results and little else
- Near misses never captured, so the richest source of learning is absent
- Trends replaced by the current month, hiding deterioration
- Risks judged out of scope in an earlier assessment quietly disappear rather than being re presented
Done well, what the file shows
Done well, this clause leaves a review pack demonstrably covering every required input that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Verify the review inputs include provider ownership and service catalogue changes.