When selecting solutions to mitigate unacceptable risks and single points of failure, the activity/resource owner will take into account:

The selection of business continuity solutions is a critical step in the BCM lifecycle that follows the Business Impact Analysis (BIA) and risk assessment. This activity, often called an options appraisal, requires the activity or resource owner to evaluate potential solutions. This evaluation involves a detailed comparison of the advantages (e.g., effectiveness in meeting the RTO, ease of implementation, reliability) and disadvantages (e.g., cost, complexity, resource requirements) of each option. The goal is to choose the most appropriate and cost-effective solution that mitigates the identified unacceptable risks and single points of failure while meeting the organization's recovery requirements.

A. Findings from the BIA are an input that defines the requirements for a solution (e.g., the RTO), not the criteria for selecting one solution over another.

B. The risks expected to materialise are identified during the risk assessment phase, which precedes the selection of specific mitigation solutions.

D. The Business Continuity culture index is a high-level metric of program maturity and embedding, not a direct factor in the technical and financial evaluation of a specific solution.

1. Business Continuity Institute (BCI)

Good Practice Guidelines (GPG)

2018 Edition. In Professional Practice 4: Business Continuity Solutions

Section 6.4

"Selecting business continuity solutions

" it states: "The selection process should consider a range of factors

including... cost versus benefit; and the advantages and disadvantages of each solution." This directly supports that weighing advantages and disadvantages is the core of the selection activity.

2. ISO 22301:2019

Security and resilience — Business continuity management systems — Requirements. Clause 8.3.3

"Selection of business continuity strategies and solutions

" requires the organization to "select appropriate strategies and solutions" that enable it to meet its recovery requirements. This selection process inherently involves an evaluation of the pros and cons of different options to determine their appropriateness.

3. Hiles

A. (2011). The Definitive Handbook of Business Continuity Management (3rd ed.). Chapter 20

"Determining the Business Continuity Strategy

" details the process of identifying and evaluating a range of strategy options. It emphasizes that "each option should be evaluated against a set of criteria

" which includes costs

benefits

risks

and overall impact

aligning with the analysis of advantages and disadvantages.