Business continuity strategies are the approaches an organisation selects to protect, continue and recover its prioritised products and services within agreed recovery times.
A business continuity strategy is a high-level decision about how a prioritised activity will be kept going, or brought back, when it is disrupted. It sits between the analysis and the plans: the business impact analysis (BIA) and risk assessment show what matters and how long the organisation can be without it, and the strategy decides how that will be achieved.
In the BCI Good Practice Guidelines (GPG 7.0) this is Professional Practice 4, Solutions Design. In ISO 22301:2019 it is clause 8.3, which asks the organisation to determine and select strategies and solutions based on the BIA and risk assessment. The guidance standard ISO 22313 explains the intent in more detail. Strategies are then turned into plans under Professional Practice 5, Enabling Solutions. See the wider BCMS framework.
ISO 22301:2019 clause 8.3.2 expects strategies to protect prioritised activities, and to stabilise, continue, resume and recover them, while managing the impacts.
Reduce the likelihood or effect of a disruption before it happens.
Bring the situation under control and limit further harm.
Keep prioritised activities running, at an agreed minimum level.
Restart activities that stopped, within their recovery time objective.
Return to normal operations and learn from the event.
Strategy options are usually worked out resource by resource. ISO 22301 clause 8.3.4 lists the resources to consider: people, information and data, buildings and work environment, equipment and consumables, ICT, transport, finance, and partners and suppliers.
The option must restore the activity within its recovery time objective (RTO), at the minimum level of service the organisation has agreed.
Cost, effort and complexity are weighed against the impact avoided. A cheaper option that misses the RTO is not a solution.
Each option carries its own risks and dependencies. The residual risk must be understood and accepted by the owner.
The option has to be practical for the organisation, available when needed, and testable through exercises.
Alongside resource options, leadership decides where risk is accepted, reduced by controls, or transferred, for example through insurance or outsourcing.
Chosen strategies are approved by top management and recorded, so budgets, plans and exercises can follow from them.
Solutions Design and strategy selection are taught in the BCI Certificate (CBCI) course based on GPG 7.0, delivered by ADVOX as accredited training.
Instructor-led online delivery covering all six Professional Practices.
See current dates and book on the course calendar, or ask about in-house delivery for your team.
Related: CBCI 7.0 Certification Course, BCI specialist courses and business continuity exercises, which test whether chosen strategies work.
Facilitated sessions to compare options per resource against RTOs, cost and residual risk.
The analysis that tells you which activities need which level of protection.
Business continuity and recovery plans built on the strategies you choose.
Exercises to prove the strategies work, and review against ISO 22301 and GPG 7.0.
This page is ADVOX’s own summary. Sources: BCI Good Practice Guidelines, Edition 7.0 (Professional Practice 4); ISO 22301:2019 clause 8.3; ISO 22313:2020 guidance.
We aim to reply to your enquiry within 2 hours.
