8.4.3 Warning and communication
Document and maintain procedures for communicating internally and externally with relevant interested parties covering what, when, with whom and how, for receiving, documenting and responding to communications including
5
artefacts
0
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Contact data with evidence it is maintained · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Communication procedures covering internal, external, responder and media routes · Policy repository / GRC workspace
- Verified alternate communication means that survive loss of primary systems · Policy repository / GRC workspace
- Incident log template and completed logs from exercises or real events · Policy repository / GRC workspace
- Exercise records covering the warning and communication procedures specifically · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Communication cascade depends on the corporate email and telephony that the disruption removes
- Contact lists stale, with departed staff and superseded numbers
- No decision log kept, so the response cannot be reconstructed or defended afterwards
- Inbound communication ignored, with procedures written for broadcast only
- Media response procedure exists but has never been exercised
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet