Business Continuity Strategies: Selecting Costed Options That Meet the RTO
Domain focus
Strategy questions test whether you can move from BIA output to a defensible, costed recovery option. The examiner looks for the chain: prioritized activity → RTO/RPO → resource requirement → candidate solutions → evaluation → approved strategy. A strategy that cannot be shown to meet the RTO is not a strategy.
Options by resource category
- People - cross-training, succession for key roles, remote working, retained contractors, mutual aid.
- Facilities - hot, warm and cold sites, reciprocal agreements, mobile or temporary accommodation, work-from-home capacity.
- Technology - high availability and clustering, synchronous versus asynchronous replication, multi-zone cloud, backup and restore (cheap, but rarely fast enough for short RTOs), DR tiers matched to impact.
- Data - replication and backup aligned to RPO, plus retention and integrity checks.
- Suppliers - dual sourcing, contractual continuity and audit rights, buffer stock, pre-qualified alternates.
- Process - manual workarounds, prioritised backlog rules, reduced service levels agreed in advance.
Evaluation criteria
Compare options on capability against the RTO/RPO; total cost against the time-based cost of loss; dependencies the option itself introduces; single points of failure; implementation lead time; residual risk, formally accepted by the owner; and regulatory or contractual obligations. Include "accept the risk" as an explicit option with a stated rationale and approval.
Worked example
Settlement must resume within 12 h. Option A: warm site with a tested four-hour failover - meets the RTO at moderate cost, but 15 staff must travel 60 km, so travel and staff availability count inside the 12 h. Option B: active-active across two data centres - faster, three times the cost, yet covers only the application tier, not the print and post room the regulator requires. Option C: manual reconciliation for up to 24 h - fails the 12 h RTO. Selection: Option A plus a dual-sourced print supplier and a pre-agreed staff travel roster; B is retained for the database tier only.
Traps
Choosing a technology solution before the BIA exists; treating insurance as a continuity strategy (it funds recovery, it does not perform it); ignoring staff travel, accommodation and welfare; assuming a reciprocal agreement holds during a regional event; and approving a strategy with no implementation plan, owner or budget.
Exercise, Test and Evaluation: Building Evidence Rather Than Theatre
Domain focus
Exercise and test questions examine whether you can build a programme that produces evidence. The examiner wants to see objectives, scope, scenario, type, evaluation and a corrective action loop - not a calendar of events.
Discussion-based and operations-based
Discussion-based: seminar (orientation), workshop (process walk-through), tabletop (scenario-driven decision-making), game (competitive simulation). Operations-based: drill (a single skill), functional (a function under simulated conditions, such as failover), full-scale (end-to-end, involving responders). Increase complexity progressively: walk through before you switch systems; switch systems before you invoke the whole organisation.
The programme
Per ISO 22301 clause 8.5, the exercise programme is planned, with objectives, scope, type, scenario, timeline and criteria for evaluating success, and it includes relevant interested parties - suppliers, landlords, key customers, public authorities where appropriate. It is proportionate to risk: high-impact activities and short RTOs deserve more frequent and more demanding exercises. Record the required frequency and how it is met.
Running a single exercise
- State measurable objectives ("declare within 30 minutes", "restore order entry within 4 hours").
- Agree scope and what is explicitly out of scope.
- Choose a plausible scenario aligned to the risk assessment.
- Design evaluation criteria and observer forms before the day.
- Brief participants, withholding scenario detail where surprise adds value.
- Provide safety controls and a stop authority for operations-based events.
- Run a hot wash, then a written after-action report separating observations from recommendations.
- Log corrective actions with owner, date and verification; feed them into the next cycle and management review.
Worked example
Objective: verify the 12-hour settlement RTO. A functional exercise fails the gateway over to the warm site on a Saturday. Observed: failover took 5 h 10 m and two of the 15 required staff could not be reached. Reasoning: the objective is met on technology but not on people, so the finding is a call-tree and roster defect rather than a site defect - corrective actions go to HR and the recovery coordinator respectively.
Traps
Running an exercise with no objective and declaring it successful; starting with full-scale; having no evaluation criteria, so findings are opinion; omitting safety or stop authority; and after-action reports whose actions are never tracked to closure.