ISO/TS 22331:2018 provides guidance on business continuity strategy. Its practical value is the bridge between BIA requirements and the capabilities that plans later activate. Strategy work asks which recovery options can realistically meet time, minimum-service and dependency requirements.
What this means in practice
Plans written before strategy decisions often describe capabilities that have never been funded or tested. Evaluate people, premises, technology, information, suppliers, logistics and utilities as a coordinated design and record the residual risk when no option fully meets the need.
Decision and evidence map
| Area | Practical question | Evidence |
|---|---|---|
| Requirement | What RTO/MBCO/RPO or service need must be achieved? | Approved BIA |
| Option | Which recovery approaches are feasible? | Alternative designs and assumptions |
| Capacity | Can the option support required scale at the required time? | Capacity calculations/test |
| Dependency | What could make the option fail simultaneously with primary capability? | Shared dependency analysis |
| Cost/risk | What implementation and residual risks exist? | Business case and risk decision |
| Validation | How will critical assumptions be proven? | Exercise/test objectives and evidence |
Practical implementation checklist
- Start with approved BIA requirements.
- Generate multiple options for each material resource dependency.
- Evaluate time, capacity, geography, security, obligations and cost.
- Identify shared dependencies and concentration risks.
- Approve selected solutions and record unresolved gaps.
- Implement capability before relying on it in response plans.
- Exercise the assumptions at realistic scale and update strategy when evidence changes.
Worked example
A remote-work option looks inexpensive until the team checks that only 100 VPN sessions are available while 450 users are needed to deliver the MBCO. Strategy evaluation makes the shortfall visible before an incident. Management can increase capacity, split work across an alternate site, reduce the required minimum service with evidence, or explicitly accept residual risk.
Common mistakes
- Choosing the cheapest option without checking recovery capability.
- Assuming an alternate location is independent when it shares power, telecom or regional hazards.
- Treating a dual supplier as resilient without switch-time or sub-tier analysis.
- Writing procedures around capability that is still only a proposal.
- Changing BIA requirements to hide a strategy gap.
Governance, review and improvement
Strategy should be reviewed after material BIA changes, new technology, facility moves, sourcing changes, significant incidents or failed exercises. Keep requirement, expected capability and demonstrated capability visible as separate values.
Authoritative references
BCM.Center paraphrases standards and guidance; use the official publication for authoritative wording and current status.
Frequently asked questions
What is ISO/TS 22331?
ISO guidance focused on developing and selecting business continuity strategy.
Is strategy the same as a BCP?
No. Strategy establishes recovery capability; a BCP describes how people activate and use that capability.
Should cost influence strategy?
Yes, together with recovery need, capacity, obligations, risk and feasibility. Unfunded gaps should remain visible.
How is strategy proven?
By exercises or tests that validate the assumptions determining whether the option can meet business requirements.
When should strategy be updated?
When recovery requirements or dependencies materially change, or evidence shows the current option no longer performs as expected.