In the Business Continuity Management (BCM) lifecycle, strategies represent the high-level, overarching approaches selected to meet the recovery requirements identified during the Business Impact Analysis (BIA) and risk assessment. They answer the question, "What will we do?". For example, a strategy might be to use a third-party hot site for IT recovery. Solutions are the specific, tactical implementations of these strategies. They detail the "how," specifying the exact resources—people, processes, technology, and facilities—required to make the strategy operational. For instance, the solution would be the specific contract with a named vendor for a particular hot site facility.

A. This is partially true but less precise. While strategies are guided by policy, solutions are the specific implementation of strategies, not just a general response to BCMS objectives.

B. This creates a false dichotomy. Both the BIA and the risk assessment are critical inputs for determining appropriate strategies, which are then implemented through specific solutions.

D. This is incorrect. Business Continuity strategies are designed for responding to and recovering from disruptions, not for "business as usual activities."

1. ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements.

Section 8.3, "Business continuity strategies and solutions," outlines the process. Clause 8.3.1 requires the organization to "identify and select business continuity strategies." Following this, Clause 8.3.2 requires the organization to determine the resource requirements and "implement the selected business continuity solutions." This sequential structure demonstrates that strategies are the high-level approaches, and solutions are their subsequent implementation.

2. Business Continuity Institute (BCI), "Good Practice Guidelines (GPG), 2018 Edition."

Professional Practice 3 (PP3): Business Continuity Strategy, page 81, states that the purpose is to "identify and select strategic options for the continuity and/or recovery of prioritized activities."

Professional Practice 4 (PP4): Business Continuity Solutions, page 97, states its purpose is to "implement the strategies and tactics that were determined in PP3." This explicitly defines solutions as the implementation of the previously determined strategies.

3. Hiles, A. (2011). The Definitive Handbook of Business Continuity Management. John Wiley & Sons.

Chapter 16, "Developing Business Continuity Strategies," describes strategy selection as choosing the appropriate methods to enable recovery within the RTO. The subsequent chapters on implementation detail the specific solutions (e.g., alternate sites, technology) needed to realize those strategies. This supports the concept of strategy as a high-level approach and solutions as the detailed implementation.