Selection of strategies and solutions

What the baseline asks

Choose among the candidates identified according to how far they meet the time frames and the capacity agreed, suit how much risk, and of what kinds, the organization is willing to accept, and hold up when their costs are weighed against their benefits.

What it means when the service runs in the cloud

Selection is a trade between recovery time, cost and operational complexity. Record why the chosen option was preferred, because a later reviewer will otherwise assume the cheapest option was chosen by default.

Evidence an auditor or a customer asks for

• Selection decision record naming the three selection factors
• Statement of the risk the organization is prepared to take that the decision was judged against
• Cost and benefit analysis behind the chosen solution
• Approval by the authority able to accept the residual exposure

Common gaps in a cloud estate

• Selection made on cost with time frames and risk appetite unexamined
• Risk appetite never articulated, so fit to appetite cannot be judged
• Residual gap between what the solution delivers and what the BIA requires left unrecorded and unaccepted

Done well, what the file shows

Done well, this clause leaves a selection decision record naming the three selection factors that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Record the reason each strategy was selected over the alternatives.