Strategic, tactical, and operational plans should always be activated:

The activation of strategic, tactical, and operational plans must be proportionate to the nature and scale of the incident. Each level of the response structure should have its own plan with clearly defined activation triggers, roles, and responsibilities. An incident may only require an operational response, while a more severe event could escalate, triggering tactical and then strategic plans. This approach ensures a scalable and appropriate response, avoiding unnecessary resource allocation or escalation. Activation is therefore determined by the specific conditions documented within the relevant plan for that team or level.

A. Simultaneous activation is inefficient and often inappropriate, as many incidents only require an operational-level response.

B. This implies an "all-or-nothing" approach, which is inflexible and prevents a scalable response to smaller incidents.

C. Activation is not exclusively a top-down process; an incident can be identified and managed at the operational level without strategic involvement.

1. Business Continuity Institute (BCI)

Good Practice Guidelines (GPG)

2018 Edition.

Section 8.3.3

Plan Activation: "The plan should clearly state the circumstances under which it should be activated... The activation criteria should be clear

concise and easy to understand

avoiding any ambiguity." This directly supports that activation is based on documented conditions within the relevant plan.

Section 8.2

Response Structure: The GPG describes the three-tiered (Strategic

Tactical

Operational) structure

noting that it provides a "scalable response to any incident." This scalability refutes the simultaneous

all-or-nothing

or purely top-down activation models proposed in the incorrect options.

2. ISO 22301:2019

Security and resilience — Business continuity management systems — Requirements.

Clause 8.4.2

Warning and communication: This clause requires procedures for internal and external communication upon incident detection.

Clause 8.4.4

Business continuity plans and procedures: Requires that procedures "contain the criteria and process for their activation." This aligns with the principle that each plan has its own documented activation triggers.