Business Continuity Strategies
Purpose
Strategies are the documented, cost-justified ways the organization will meet the RTOs and RPOs the BIA established. Every strategy must trace back to a BIA requirement and a risk finding.
Concepts you must know
- Alternate operating options - hot site, warm site, cold site, mobile/trailer, reciprocal agreement, split operations, work-from-home, manual workarounds.
- Data recovery options - backup types, offsite/offline copies, replication, journaling, cloud failover, and documented restore testing.
- Technology recovery tiers - from tape-and-rebuild through active-active, traded against cost.
- Supplier and utility redundancy, multi-sourcing, contractual continuity clauses.
- Manual workarounds - temporary procedures that bridge the gap until systems return.
- Cost-benefit and gap analysis - strategy chosen must close the gap between current capability and BIA requirement.
- Recovery sequencing - restore in dependency order, upstream first.
Traps in questions
- Choosing a hot site by default: it is expensive and may not match the RTO.
- Selecting a strategy before the BIA - a classic ordering error.
- Assuming an alternate site is useful if people cannot reach it or IT cannot fail over in time.
- Overlooking the single points of failure (one data center, one supplier, one key person).
- Forgetting that strategies need owner approval and funding, not just technical merit.
Rule of thumb
Pick the cheapest option that meets the RTO/RPO with an acceptable residual risk. If a warm site restores in 24 hours but the RTO is 8, it fails regardless of price.
Worked example: Order entry has an RTO of 4 hours and RPO of 15 minutes. A cold site cannot meet it (days to provision); tape backup cannot meet the RPO. A warm site with hourly replication is insufficient for RPO, so near-real-time replication to a secondary region is required.