Business Continuity Strategies and Solutions for ISO 22301
ISO 22301 Clause 8.3
This sub-clause requires the organisation to identify, select and resource business continuity strategies and solutions for before, during and after disruption.
ISO 22301 Clause 8.3 - Business Continuity Strategies and Solutions
Clause 8.3 sits between the analysis (8.2) and the plans (8.4). It is where the organisation decides what it is actually going to do about the priorities and risks that the analysis has surfaced. The clause covers identification of options, selection of the chosen approach, and the determination of the resources needed to make the chosen approach work.
What ISO 22301 Clause 8.3 Requires
Under Clause 8.3.1, the organisation must identify and select strategies and solutions that consider options for before, during and after disruption.
Under Clause 8.3.2, identification must be based on the extent to which strategies meet recovery requirements within selected timeframes and capacity, protect prioritised activities, reduce the likelihood of disruption, shorten the period of disruption, limit the impact on products and services, and provide for the availability of resources.
Under Clause 8.3.3, selection must consider the requirements to continue and recover prioritised activities within identified timeframes and agreed capacity, the type and amount of risk the organisation can or cannot accept, and related costs and benefits.
Under Clause 8.3.4, the organisation must determine the resources required to implement the selected solutions, including people, information and data, physical infrastructure, equipment and consumables, ICT systems, transportation and logistics, finance, and partners and suppliers.
Under Clause 8.3.5, the organisation must implement and maintain the selected business continuity solutions so they can be activated when required.
Choosing the Right Strategy
Continuity strategies fall into a few broad families. Prevention strategies aim to stop the disruption happening in the first place - redundancy in IT, secondary suppliers, fire suppression. Mitigation strategies reduce the impact when something does happen - data backups, cross-trained staff, alternative work locations. Response and recovery strategies are about how the organisation gets activities back up - manual workarounds, alternative sites, mutual aid agreements. Most organisations end up with a mix of all three, calibrated to the recovery time objectives that came out of the BIA.
The cost question matters. A strategy that delivers a four-hour RTO is generally more expensive than one that delivers a forty-eight hour RTO. The job at 8.3 is to make conscious choices that match the cost of the strategy to the impact that the BIA says justifies it.
The selected strategy lives in the business continuity register and is then expressed in the BC plan as the actions to take. Strategies are not implementation - they are the framework within which implementation happens. A clear strategy at 8.3 makes writing the plan at 8.4 a much easier job.
I look for strategies that are demonstrably linked to the BIA. If the BIA says four hours and the strategy assumes the team can work from home over the weekend, the strategy does not match the requirement. I also check that the resources have actually been determined - it is not enough to say "we will use an alternative site"; the organisation has to have decided which alternative site, what the activation is, who pays for it, and how long it takes to be operational.
Practical Compliance Guidance
The F-IMS21 Business Continuity Register and ER16 Continuity Risk Register hold the selected strategies, with the resource requirements captured against each prioritised activity. The F-Q94 Business Continuity Plan is where the strategies are expressed as actions for the response team.
| alphaZ document | How to use it |
|---|---|
| ISO 22301 Toolkit | The full set of policies, procedures, registers and plans that build a BCMS to the requirements of the standard. |
| F-IMS21 Business Continuity Register | The register that holds the selected continuity strategies and the resource requirements. |
| ER16 Business Continuity Risk Register | The register that links risks to the strategies and treatments selected to address them. |
| F-Q94 Business Continuity Plan | The BC plan that operationalises the selected strategies as response actions and recovery procedures. |
Subscribers to alphaZ have access to all of these documents and supporting material. Find out more about the alphaZ subscription.
