Business Continuity Strategy and Solution Design
From requirements to options
Strategy design converts BIA and risk outputs into viable ways to protect critical activities. The candidate must know the option families: do nothing (accept), reduce likelihood or impact through controls, avoid the activity, transfer risk (insurance, contract), and build continuity capability through redundancy, workarounds, alternate sites, manual procedures, or outsourced arrangements. Selection is a trade-off among cost, risk reduction, and residual risk accepted by the business owner.
Design concepts
- Strategy must be resource-based: people, premises, technology, data, suppliers, and information.
- Recovery tiers differ: hot, warm, cold, and reciprocal arrangements each carry different cost and recovery speed; match them to RTO, not to vendor marketing.
- Single points of failure must be identified across the whole dependency chain, including shared suppliers and shared facilities.
- Solutions need an owner, a cost, and a validation method before they enter the plan.
Traps
- Choosing a strategy that meets the RTO on paper but has never been validated.
- Confusing insurance with continuity: insurance funds recovery, it does not restore operations.
- Assuming supplier continuity arrangements are adequate without evidence.
- Designing for the technology layer only, leaving manual workarounds undefined.
- Forgetting that strategies themselves create new dependencies.
Rule of thumb
Every strategy must answer three questions: what resource does it substitute, how fast does it actually deliver, and who has accepted the residual risk in writing?
Worked example
A call centre requires a 4-hour RTO. A cold site with a 48-hour build is rejected. The chosen solution combines remote working for licensed agents and a tested reroute to a partner site, with a written residual-risk acceptance for the reduced capacity.