Business continuity strategies and solutions

What the baseline asks

Choose continuity strategies from the impact and risk findings, select the solutions that deliver them, determine the resources they need and put them into effect.

What it means when the service runs in the cloud

Strategies for cloud continuity range from a second region through a second provider to a manual workaround. Each has a different recovery time and a different cost, and none of them is real until it has been exercised.

Evidence an auditor or a customer asks for

• Strategy document traceable to BIA and risk assessment outputs
• Selection rationale for the chosen solutions
• Evidence solutions are implemented and maintained

Common gaps in a cloud estate

• Strategy chosen before the impact analysis, then justified after the fact
• Solutions procured but never maintained to a state where they could be activated
• Resource requirements of the chosen solutions never worked out

Done well, what the file shows

Done well, this clause leaves a strategy document traceable to bia and risk assessment outputs that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

List the strategy chosen for each critical service and the last time it was exercised.