Performance evaluation
9.3
Management review
Top management must review the BCMS on a planned basis against a defined set of inputs, and must record and act on the decisions the review produces.
What the baseline asks
Top management must review the BCMS on a planned basis against a defined set of inputs, and must record and act on the decisions the review produces.
What it means when the service runs in the cloud
Management review is where provider risk gets funded or ignored. Put the provider incidents, the failed tests and the expiring contracts in front of the review, not only the internal metrics.
Evidence an auditor or a customer asks for
- Scheduled review with attendance evidencing top management
- Inputs presented and outputs recorded
- Actions arising tracked to closure
Common gaps in a cloud estate
- Review delegated to the BCMS manager and the management team merely noted
- Inputs incomplete, so decisions rest on partial information
- Decisions recorded but never converted into tracked actions
Done well, what the file shows
Done well, this clause leaves a scheduled review with attendance evidencing top management that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Confirm the last management review saw provider incidents and test results.