Identification of strategies and solutions

What the baseline asks

Identify possible strategies and solutions according to how far they would: keep prioritized activities going, or recover them, within the time frames identified and at the capacity agreed; protect those activities; make a disruption less likely; make it shorter; reduce its effect on products and services; and make sure enough resources are available.

What it means when the service runs in the cloud

Identification should include the options the contract already gives you: a second region, a read replica, data export, a grace period after termination. Often the cheapest strategy is a right you have already paid for and never used.

Evidence an auditor or a customer asks for

• Option analysis scoring candidates against each identification factor
• Evidence time frame and capacity requirements came from the BIA
• Coverage of likelihood reduction options, not recovery options alone

Common gaps in a cloud estate

• Candidates assessed on cost alone at the identification stage, collapsing identification into selection
• Likelihood reduction and duration shortening factors ignored
• Capacity requirement dropped, so options are judged on time only

Done well, what the file shows

Done well, this clause leaves a option analysis scoring candidates against each identification factor that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

List the continuity options already available under each contract.