BCM-01 Top management responsibility
Name a member of top management as owner of business continuity and emergency management, accountable for establishing the process, enforcing its guidelines and ensuring sufficient resources, with leaders visibly encoura
4
artefacts
0
held by a system
1
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Appointment record naming the executive who owns continuity and emergency management · Document repository
governing documentDocuments that govern the control
- Role description setting out that owner's accountabilities · Policy repository / GRC workspace
- Budget or resourcing decision funding the continuity programme · Document repository
- Leadership communication urging staff participation in continuity activities · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Ownership delegated to an operational manager with no executive accountability
- Named owner has left the organisation and the role was never reassigned
- Programme resource requests repeatedly declined with no record of the decision
- No sign of leadership engagement beyond a signature on the policy
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetAM-06 Asset Classification and Labelling · BCM-02 Business impact analysis policies and instructions