Management review outputs

What the baseline asks

The review must lead to decisions on chances for continual improvement and on any changes that would make the BCMS more efficient and effective. These cover changes to scope; updates to the business impact analysis, the risk assessment, the strategies, the solutions and the plans; changes to procedures and controls so they respond to internal or external issues; and the way control effectiveness is to be measured. Keep documented evidence of the outcome, tell the relevant interested parties about it, and act on it as appropriate.

What it means when the service runs in the cloud

Outputs should assign the work that closes the gaps: a contract change, a second region, a test, a budget line. An output without an owner and a date is a minute, not a decision.

Evidence an auditor or a customer asks for

• Minutes recording decisions against each required output area
• Actions with owners and dates traceable from the decisions
• Communication records to relevant interested parties
• Evidence of the resulting change in the BCMS artefacts

Common gaps in a cloud estate

• Minutes that record discussion but no decisions
• Decisions on how control effectiveness will be measured omitted, so measurement never improves
• Results not communicated beyond the review attendees
• Actions raised and then closed administratively at the next review without evidence

Done well, what the file shows

Done well, this clause leaves a minutes recording decisions against each required output area that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Check every review output has an owner and a due date.