8.1 Operational planning and control
Plan, implement and control the processes needed to meet BCMS requirements and to carry out the actions determined under risks and opportunities, by establishing process criteria, controlling the processes against those
4
artefacts
1
held by a system
2
at each review
moderate
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Records showing processes ran to those criteria · Document repository
periodic reviewEvidence produced at each review
- Change records covering planned changes and reviews of unintended change · Document repository
- Evidence of control over outsourced processes and the supply chain · Vendor register / contract repository
governing documentDocuments that govern the control
- Documented process criteria for BCMS operational processes · Document repository
First move
Start with the 1 of 4 artefacts that already live in a system (Document repository); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Supply chain control asserted through contract clauses with no verification behind them
- Criteria absent, so control of a process cannot be demonstrated
- Unintended changes never reviewed because nothing detects them
- Outsourced processes treated as the provider's problem
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.5.3 Control of documented information · 8.2 Business impact analysis and risk assessment