ISO 22301 Business Continuity Strategy and Solutions

Do not choose a continuity solution before the BIA and disruption-risk assessment have produced usable inputs. For each prioritized activity, the strategy record should identify the product or service supported, when disruption impacts become unacceptable, the earlier prioritized resumption time frame, the specified minimum acceptable capacity, and the resources and dependencies needed to meet it.

This keeps the strategy discussion practical. A recovery-site option, alternate supplier, manual workaround, cloud failover, communications plan, or staffing arrangement is only useful if it maps back to a prioritized activity and the time frame the organization has agreed it must meet.

Keep a traceable chain: activity, impact criteria, the time frame when impacts become unacceptable (often called MTPD), the earlier resumption time frame (often called RTO), minimum acceptable capacity, resources, dependencies, selected strategy and solution, owner, exercise method, and review trigger. ISO 22301:2019 does not define RPO, so identify any data-loss target as an additional organization-specific or technology requirement.

Identify options for before, during, and after disruption. Clause 8.3.2 asks whether they protect prioritized activities, reduce disruption likelihood, shorten disruption, limit impact on products and services, provide adequate resources, and meet the required time frames and capacity. Illustrative options include redundancy, alternate capacity, manual workarounds, backup and restoration, alternate premises, or supplier arrangements. ISO 22301 sets selection outcomes, not a required technology or vendor list.

Selection under Clause 8.3.3 considers whether the option meets the required time frames and capacity, the amount and type of risk the organization may or may not take, and associated costs and benefits. If a selected option cannot meet the continuity requirement, record the gap and change the requirement through a supported BIA and management decision or improve the solution; labeling the gap as accepted risk does not by itself demonstrate conformity.

A strategy set may combine people, premises, technology, information, equipment, finance, transport, suppliers, and communication arrangements. Buying one tool does not establish ISO 22301 conformity.

Clause 8.3.5 requires selected solutions to be implemented and maintained so they can be activated when needed. Assign owners, provide the resources identified under Clause 8.3.4, document activation steps, prepare relevant people, and connect each solution to the plans and procedures that use it. The related plans should also define activation thresholds, coordination, reporting, stand-down, and the return from temporary measures.

For technology continuity, evidence may include failover design, backup and restoration records, access paths, monitoring, runbooks, and recovery test results. For people and premises, it may include alternate-location arrangements, call trees, role deputies, shift plans, workspace access, and safety or communication procedures.

Supplier-dependent solutions need their own proof. A contract clause or supplier name is weak evidence unless the organization has confirmed the supplier role, capacity, contact path, escalation process, and review or exercise approach.

Clause 8.5 requires a programme of exercising and testing that validates strategy and solution effectiveness over time. Exercises need planned scenarios with defined aims and objectives and must produce formal post-exercise reports with outcomes, recommendations, and improvement actions.

Use different exercise types depending on the risk and maturity of the solution. A tabletop can test decision paths and communications; a technical recovery test can test data, access, capacity, and timing; a supplier exercise can test external coordination; and a post-incident review can test whether real disruption lessons require strategy changes.

A failed exercise can still support improvement when the organization records the outcome, acts on it, and verifies the change. It does not prove that the tested strategy or solution was effective.

Evaluate strategies and solutions at planned intervals, after an incident or activation, and when significant changes occur. Clause 8.6 also calls for evaluation of the BIA, risk assessment, plans, procedures, and relevant partner and supplier capabilities, followed by timely updates.

Evidence maintenance is easier when each solution has a compact evidence pack: BIA reference, selected strategy, resource decision, plan link, test record, open actions, supplier evidence where relevant, owner, last review date, and next trigger for review.

Management review should receive unresolved gaps, underfunded resource needs, supplier weaknesses, repeated exercise failures, accepted risks, and proposed BCMS improvements that require a decision.