ISO/TS 22331:2018 provides guidance for determining and selecting business continuity strategy; practitioners should use it to compare feasible options against continuity requirements, dependencies, risk and lifecycle cost rather than jumping directly to a preferred technology.
Current status matters
As of September 2026, ISO lists ISO/TS 22331:2018 as the published technical specification and indicates that a replacement is under development. Treat the published specification as the current reference while monitoring the revision through standards governance; do not present committee-draft material as a final requirement.
Start from requirements, not solutions
Strategy begins with what must be achieved: priority products/services, time objectives, minimum capacity, data needs, people and facility requirements, dependencies and obligations. A second data centre, work-from-home arrangement or alternate supplier is only useful if it can meet those requirements under the disruption scenarios that matter.
Compare options transparently
| Criterion | Question |
|---|---|
| Capability | Can the option meet time, data and capacity requirements? |
| Dependency resilience | Does it remove the failure mode or reproduce it? |
| People | Are skills, access and decision authority available during disruption? |
| Supplier | Are contractual recovery commitments aligned and testable? |
| Cost | What are implementation and lifecycle costs? |
| Complexity | What operational burden or new failure modes are introduced? |
| Assurance | How will the capability be exercised and evidenced? |
Test concentration and correlated failure
Two resources are not independent merely because there are two of them. Check shared power, network, identity, cloud region, supplier, staffing, transport and administrative dependencies. Strategy review should explicitly ask which scenarios could defeat primary and alternate capability at the same time.
Record why the strategy was selected
Maintain the options considered, assumptions, evaluation criteria, rejected alternatives, residual risks, approving authority and conditions for review. This makes future change defensible and prevents the organisation from inheriting an expensive strategy whose original rationale has disappeared.
Practitioner review checklist
- Confirm the scope, accountable owner and decision authority are explicit.
Model strategy options at service level
For each priority service, compare realistic options across people, facilities, technology, information and suppliers. Record the capacity delivered, time to become usable, single points of failure, dependencies, implementation cost and operational constraints. The purpose is to make trade-offs visible rather than defaulting to the most familiar solution.
Test assumptions before approval
If a strategy assumes remote work, verify that the required number of staff can authenticate, access applications and work securely during a site-wide outage. If it assumes supplier substitution, confirm onboarding time, data transfer, capacity and contractual rights. Strategies fail when assumptions are documented but never demonstrated.
Consider correlated disruption
Two recovery options are not independent if they rely on the same power grid, telecommunications provider, identity platform, region or specialist team. Map common dependencies and test scenarios that remove more than one layer at once. This is especially important for cloud, outsourced and geographically concentrated services.
Record the decision rationale
Retain the options considered, evaluation criteria, rejected alternatives, residual risk, approving authority and review triggers. When business priorities or technology change, this record helps determine whether the strategy is still valid or must be redesigned.
Strategy review triggers
Reassess the selected strategy after major technology change, supplier replacement, acquisition, site move, significant incident, failed test or material shift in recovery requirements. Record whether the trigger changes capacity, timing, dependency or cost assumptions. A strategy remains credible only while its assumptions remain true.
Turn strategy options into an explicit decision record
A continuity strategy is stronger when the organization can show why one option was selected and why plausible alternatives were rejected. Build a decision record for each critical product, service or dependency. Record the disruption assumptions, minimum capacity required, target recovery time, people and technology constraints, supplier lead times, premises constraints and the cost or risk trade-off. The useful question is not “do we have a strategy?” but “would this option still work if the primary site, a key supplier or a critical technology dependency were unavailable at the same time?”
For example, a remote-work strategy may appear inexpensive until the team tests identity access, endpoint availability, telephony, bandwidth, privileged administration and minimum staffing at the same time. A reciprocal-site arrangement may look practical until both sites depend on the same utility, carrier or regional workforce. A manual workaround may satisfy a short interruption but become unsafe or inaccurate after several hours. Capturing these constraints makes the selected strategy auditable and gives management a clear basis for accepting residual risk.
Evidence that a continuity strategy is feasible
- Capacity evidence: demonstrate that alternate people, workspace, technology or supplier capacity can support the defined minimum level of service.
- Time evidence: show that activation, travel, access, restoration and handover steps fit inside the recovery objective rather than being assumed to do so.
- Dependency evidence: identify common-mode dependencies that could defeat more than one strategy option at once.
- Test evidence: use exercises, failover tests, supplier attestations or operational trials to validate the most important assumptions.
- Decision ownership: name who approves the strategy, who funds the gap and who can accept the residual exposure.
Review the strategy after material changes to services, volumes, technology, premises, suppliers or regulatory obligations. The purpose of the review is not to reissue a document; it is to confirm that the option remains executable under the conditions for which it was selected.
Strategy option appraisal: compare feasibility, not labels
A continuity strategy should be selected through an explicit option appraisal. For each critical activity, compare at least the viable alternatives such as alternate workspace, remote operation, manual workaround, reciprocal capacity, third-party recovery, cross-training, stock buffering or technology resilience. Score each option against the required recovery time, minimum capacity, people availability, information needs, supplier dependencies, implementation lead time and cost. An option that is inexpensive but cannot meet the recovery objective is not a valid strategy.
Evidence package for approval
The approval record should show the BIA requirement that drove the strategy, alternatives considered, assumptions, capacity calculation, single points of failure, residual risk and the exercise that will prove the selected option. For example, a remote-work strategy is incomplete if it assumes 300 concurrent users but VPN licensing, laptops, privileged access or telephony can support only 180. Record the capacity gap and either fund it, introduce staged recovery or formally accept the residual exposure.
Lifecycle check
Revalidate the strategy when process volumes, premises, technology, suppliers, staffing models or recovery objectives materially change. The useful control is not a document review date; it is evidence that the selected strategy can still deliver the required capability under current operating conditions.
Related BCM.Center resources: Business Continuity Strategy Guide: From BIA to Feasible Recovery · Business Impact Analysis (BIA) Guide.