Business continuity policy
A current policy, set by top management, that fits the organization, frames the objectives, commits to requirements and improvement, and reaches the people who need it.
01What applies
Maintain a business continuity policy that top management has set. It has to suit the organization's purpose, give a frame for setting continuity objectives, commit the organization to satisfying applicable requirements and to continually improving the BCMS, and be communicated inside the organization and made available to interested parties where appropriate. The clause does not prescribe a length. It prescribes a job: the policy is the document that tells a reader why the BCMS exists and what it will not compromise. A policy that could be pasted into any organization fails the first test.
02Why it matters
The policy is the one page a new executive will actually read. It sets the tone for whether continuity is a compliance exercise or an operating commitment. It also anchors the objectives: if the policy says nothing about recovery expectations, the objectives have nothing to be consistent with. The communication requirement is where most policies fail, because publication on an intranet nobody visits is not communication.
03What good looks like
Rewrite the policy in five short paragraphs: purpose, the services it protects, the commitments, the objectives frame, and who owns it. Name the interested parties who will receive it. Send it with a covering note from the executive owner, and record who received it. Review it at the same time as the objectives.
04Evidence an auditor asks for
Read the policy to a person outside the BCMS and ask what the organization promises. If they cannot say, the policy is not doing its job.
| Evidence | The record |
|---|---|
| Policy | Current policy approved by top management, with a review date |
| Communication | Distribution records showing who received it and when |
| Availability | Evidence the policy is obtainable by interested parties where appropriate |
05Where it commonly fails
- Policy approved once and left unreviewed through several reorganisations
- Published on an intranet nobody is directed to
- No decision recorded about which interested parties should receive it
06What to do before the estimate
Cut the policy to one page, add a review date, and send it with a two-line note to the ten people who most need it.