Business continuity strategies and solutions
Choose strategies from the impact and risk findings, select the solutions that deliver them, work out the resources and implement them so they can actually be activated.
01What applies
Choose continuity strategies from the impact and risk findings, select the solutions that deliver them, determine the resources they need and put them into effect. The clause breaks into identification, selection, resource requirements and implementation. It expects the strategy to be traceable to the impact analysis and the risk assessment, the selection to have a recorded rationale, and the solution to be implemented and maintained. A solution that exists in a contract but has never been activated does not satisfy the purpose. The resource requirement is where most strategies quietly fail.
02Why it matters
This is where continuity becomes real and where budgets are decided. The clause stops the common pattern of choosing a solution first and writing the analysis to justify it. It also makes the strategy set explainable to a board: this service needs this recovery time, this solution delivers it, this is the cost, and this is what we accepted by choosing it.
03What good looks like
For each prioritized activity, list the candidate strategies, score them against the recovery requirement and the risk, and record why the chosen one wins. Write the resource requirement per solution: people, technology, space, supplier, money. Implement in stages and record the activation test. Keep the accepted residual risk visible to the executive.
04Evidence an auditor asks for
Ask for the activation test of the solution that protects the most critical service. If it has never been activated, it is a plan, not a solution.
| Evidence | The record |
|---|---|
| Strategy | Strategy document traceable to the impact analysis and risk assessment |
| Selection | Selection rationale for each chosen solution, with alternatives considered |
| Resources | Resource requirement per selected solution |
| Implementation | Implementation and maintenance records showing each solution can be activated |
05Where it commonly fails
- Strategy chosen before the impact analysis and justified after the fact
- Solutions procured but never maintained to an activatable state
- Resource requirements never worked out
06What to do before the estimate
Take the three most critical activities and write one line per solution: requirement, solution, resource, activation test, residual risk.