ISO 22301 FAQ Recovery Strategies

A business continuity strategy is the selected approach for protecting, continuing, or recovering prioritized activities. Each strategy must comprise one or more solutions that can be activated when needed, such as an alternate site, manual workaround, supplier substitution, technology failover, staffing arrangement, inventory buffer, or communication path.

The strategy should also address the disruption risks identified for the activity and its required resources. A page that only says "restore service quickly" is not enough; the record should show which product, service, activity, dependency, resource, and owner the strategy protects.

Start with BIA outputs: products and services in scope, impacts over time, the unacceptable-impact timeframe, prioritized resumption timeframes, minimum acceptable capacity, prioritized activities, resources, and dependencies. Add RPO only where the organization has chosen a supporting data-loss target; ISO 22301:2019 does not define or explicitly require it. Then compare feasible strategies against disruption risks for the activities and resources.

Selection must consider whether the strategy meets the identified timeframes and agreed capacity, the amount and type of risk the organization may or may not take, and associated costs and benefits. For example, a warm standby environment only supports the BCMS if it covers the required application, data, people, supplier links, access rights, communications, capacity, and activation conditions.

Evidence should show that the strategy can be activated, not merely that it was named in a document. Keep the selected strategy, resource requirements, implemented solution, continuity plan or procedure, exercise/test result, post-exercise actions, and any management-review decision together or cross-linked.

Good evidence covers the resource categories ISO 22301 identifies: people; information and data; physical infrastructure and utilities; equipment and consumables; ICT systems; transportation and logistics; finance; and partners and suppliers. Name owners and verify that each resource will be available when the solution is activated.

Review strategies at planned intervals and after significant changes to the organization, context, prioritized activities, resource requirements, suppliers, sites, systems, legal obligations, customer commitments, or disruption risks. ISO 22301 also expects exercising and testing over time to validate business continuity strategies and solutions.

If a test shows the selected solution cannot meet the required time frame or capacity, the issue should not stay buried in the exercise report. Update the strategy, plan, resource decision, corrective action, and management-review inputs so the BCMS reflects the real recovery capability.