Design
Selecting recovery strategies
Design converts analysis into costed, feasible recovery strategies for each critical activity and dependency. Options include avoiding, reducing, transferring or accepting risk, and recovery approaches such as hot, warm or cold sites, cloud services, reciprocal arrangements, manual workarounds, alternate suppliers, cross-trained staff and duplicate equipment. Evaluate each option against RTO, MTPD, RPO, MBCO, risk appetite, cost, feasibility, dependencies and single points of failure. Then conduct a gap analysis between current capability and the required strategy, and document residual risk and assumptions. Strategy is not the plan: strategy defines the chosen recovery approach; the plan defines how it is executed.
Traps
A frequent trap is choosing a strategy before the BIA, or letting cost alone drive the decision. Another is assuming IT disaster recovery equals business continuity. Questions may expose reliance on one site, one supplier or one skilled person. Do not confuse strategy with a documented plan, and do not over-engineer beyond the RTO and MBCO.
Worked example
Payment processing has an MTPD of 24 hours, RTO of 4 hours and RPO of 15 minutes. A cold site fails the RTO; a warm site with data replication may meet it; active-active cloud meets it but costs more. If regulatory impact justifies the cost, choose active-active and document residual risk.
Rule of thumb: the strategy must satisfy RTO < MTPD and the RPO, be feasible and be tested.