The Requirements and Strategy phase of the Business Continuity Life-cycle comprises:

The "Requirements and Strategy" phase of the Business Continuity Life-cycle is foundational. It begins with a Business Impact Analysis (BIA) to identify critical business processes and the impact of their disruption, thereby defining the requirements for recovery. Concurrently, a Risk Assessment identifies threats and vulnerabilities. The outputs of both the BIA and Risk Assessment are then used to formulate and select an appropriate Business Continuity Strategy. This strategy outlines the approach the organization will take to ensure resilience and recovery, directly addressing the identified requirements and risks. This sequence forms the core of the analysis and strategic planning stage in any recognized business continuity management framework.

A. Initial testing, Education and Awareness, and Assurance are activities that occur later in the life-cycle, primarily within the implementation, embedding, and validation/review phases, not the initial requirements phase.

B. Education and Awareness is part of embedding the BCM culture, while Review and Audit are components of the performance evaluation and continual improvement phase, which follows implementation.

C. Implementation Planning and Risk Reduction Measures are part of the subsequent design and implementation phases. They are actions taken after the core strategy has been determined.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Section 8.2.2, "Business impact analysis and risk assessment," mandates these activities to understand the organization's priorities and risks.

Section 8.3, "Business continuity strategy and solutions," requires the selection of strategies based on the outputs from Section 8.2.2. These sections collectively represent the requirements and strategy determination phase.

2. Business Continuity Institute (BCI), "Good Practice Guidelines (GPG), 2018 Edition."

Professional Practice 3 (PP3), "Analysis," details the process of conducting a Business Impact Analysis (BIA) and a risk assessment to determine continuity requirements.

Professional Practice 4 (PP4), "Design," describes how to use the outputs from the Analysis phase to identify and select appropriate strategies to meet the identified requirements.

3. Herbane, B. (2010). The evolution of business continuity management: A historical review of practices and drivers. Business History, 52(6), 978-1002.

This academic review discusses the evolution of BCM, consistently identifying BIA and risk assessment as the analytical foundation (requirements) upon which continuity strategies are built (p. 985). DOI: https://doi.org/10.1080/00076791.2010.511185