Business Continuity Strategy and Solution Design
Strategy selection translates BIA and risk outputs into cost-effective options that meet RTO, RPO, and MBCO targets. The classic strategy hierarchy is: avoid or reduce the risk, transfer it (insurance), accept it, or build continuity capability. For each priority activity, candidates should be able to compare options such as alternate sites (hot, warm, cold), manual workarounds, resource redundancy, outsourcing, and staggered recovery sequencing.
Key concepts: recovery sequencing (not everything can recover first), resource requirements (people, facilities, technology, suppliers, data), and the trade-off between recovery capability and cost. Hot sites offer near-immediate recovery at high cost; warm sites offer partial readiness; cold sites offer space only. Distributed or virtualized environments blur these categories, so focus on actual recovery time and data currency rather than labels. Also understand single points of failure, geographic separation, and third-party dependency risk.
Traps: choosing the most robust strategy regardless of cost or business need; assuming insurance is a continuity strategy (it funds recovery, it does not restore service); ignoring people and supplier dependencies while focusing only on IT; and failing to verify that a strategy meets the RTO with evidence from testing.
Worked example: an order-entry function has an RTO of 4 hours and an RPO of 30 minutes. A cold site cannot meet this. A warm site with replicated data and pre-staged workstations might meet it if staff can travel within the window; a hot site or remote-work capability with continuous replication is safer but costlier. Present the options with cost, recovery time, and residual risk, then let management select.
Rule of thumb: strategy must satisfy the RTO, fit the budget, and be testable. If you cannot exercise it, you cannot claim it.