General

What the baseline asks

Using what the impact analysis and the risk assessment produced, identify and choose business continuity strategies that look at options for the periods ahead of, during and following a disruption, each strategy being made up of one or more solutions.

What it means when the service runs in the cloud

The general requirement is that strategies exist for every critical activity, including the ones that only look resilient because the provider says so. Read the provider's own recovery documentation before accepting it as your strategy.

Evidence an auditor or a customer asks for

• Traceability from BIA and risk assessment outputs into the strategy options considered
• Options covering the before, during and after phases
• Record of which solutions make up each selected strategy

Common gaps in a cloud estate

• Only during disruption options considered, with nothing done to reduce likelihood beforehand
• Strategy stated at a level too high to name any actual solution
• Options never documented, so only the chosen one is visible

Done well, what the file shows

Done well, this clause leaves a traceability from bia and risk assessment outputs into the strategy options considered that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Check every critical activity has a strategy that does not rely on an unverified provider claim.