# Clause 8.3.1: General

Using what the impact analysis and the risk assessment produced, identify and choose business continuity strategies that look at options for the periods ahead of, during and following a disruption, each strategy being made up of one or more solutions.

Cloud: The general requirement is that strategies exist for every critical activity, including the ones that only look resilient because the provider says so. Read the provider's own recovery documentation before accepting it as your strategy.

Evidence: Traceability from BIA and risk assessment outputs into the strategy options considered; Options covering the before, during and after phases; Record of which solutions make up each selected strategy.

Test: Check every critical activity has a strategy that does not rely on an unverified provider claim.

Citation: ISO 22301:2019, clause 8.3.1. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.