PP4: Solutions Design – Matching Protection to the Cost of Disruption

GPG 7.0 Series Note: This is Part 4 of our deep dive into the BCI Good Practice Guidelines (GPG 7.0). Having identified critical activities, MTPDs, and RTOs in PP3: Analysis, Professional Practice 4 focuses on designing cost-effective, pragmatic continuity strategies to meet those targets (see my original PP4 Learning Notes for CBCI exam preparation).

The GPG 7.0 Overview:

1. PP1: Policy & Programme Management
2. PP2: Embedding Continuity
3. PP3: Analysis (BIA & Risk Assessment)
4. PP4: Solutions Design ← (You are here)
5. PP5: Enabling Solutions
6. PP6: Validation

The Core Objective

The purpose of Professional Practice 4 (Solutions Design) is to identify, evaluate, and select practical options that allow an organisation to maintain its Minimum Business Continuity Objective (MBCO) during a crisis.

For many senior leaders, Business Continuity (BC) is viewed as a fiscal "black hole"—an endless drain on the IT budget fuelled by "just in case" paranoia. GPG 7.0 reframes Solutions Design as the strategic pivot where an organisation moves from analysis to cost-effective action. The core principle is simple: match the cost of protection to the cost of disruption.

Strategy vs. Solution: The Blueprint vs. The Building

A common pitfall in BC governance is confusing "having a strategy" with "having a solution". In GPG 7.0, this distinction is critical for resource allocation and board sign-off.

• The Strategy (The Blueprint): A high-level concept outlining how an activity will be resumed (e.g., "We will pivot to remote working and use secondary cloud infrastructure").
• The Solution (The Building): The specific, costed, and contracted capability required to execute the strategy (e.g., pre-provisioned laptops, dual-homed VPN licences, and 24/7 technical support SLAs).

Key Insight: Relying on a strategy without a documented, resource-backed solution creates a culture of "heroic" ad-hoc responses. A mature BCMS moves an organisation from person-dependent heroics to system-dependent architecture.

The Six Resource Pillars of Resilience

True operational resilience extends far beyond traditional IT Disaster Recovery. GPG 7.0 mandates evaluating six core resource pillars to support critical activities:

• 1. People: Addresses skills, deputisation, and cross-training.
• 2. Premises: Covers physical facilities, remote working, and alternative sites.
• 3. Technology: Focuses on core systems, platforms, and critical APIs.
• 4. Information: Protects vital records, data integrity, and recovery points (RPO).
• 5. Supplies & Suppliers: Manages priority vendors and supply chain dependencies.
• 6. Stakeholders: Coordinates internal and external crisis communications.

Executive Impact Statement:
By evaluating all six resource pillars, an organisation can target capital expenditure directly toward core statutory digital platforms while accepting manual workarounds for secondary policy functions. This maintains critical service delivery during a disruption without over-specifying operational budgets.

The Category A–E Spectrum: Matching Velocity to Vitality

GPG 7.0 categorises recovery options into a spectrum of "speed vs. cost," enabling leadership to make informed financial trade-offs:

• Category A (Hot / Immediate): Near-zero RTO. Essential for high-stakes digital platforms where any downtime causes severe operational or legal impact.
• Categories B & C (Warm / Standby): Delayed recovery (hours to days). Resources are pre-staged for structured activation.
• Category D (Cold / Reconstructed): Rebuilt from scratch post-incident. Applied to low-priority activities with long lead times.
• Category E (Manual Workarounds): Pragmatic pivots, such as replacing automated systems with manual telephony or paper-based workflows during a disruption.

Executive Governance & Residual Risk Sign-Off

Resilience governance relies on a clear Separation of Duties:

1. The BC Professional (Assessor): Conducts gap analyses, evaluates feasibility, and presents costed options.
2. Top Management (Decision Maker): Selects the final option, allocates budget, and formally accepts the Residual Risk—the risk remaining after a solution is implemented.

Inherent Risk → [ PP4 Solutions Design ] → Residual Risk (Executive Sign-Off)

This formal sign-off establishes a defensible position, proving that risk decisions were grounded in objective BIA data rather than emotional reactions during a crisis.

Key Terminology Reference

• Minimum Business Continuity Objective (MBCO): The minimum level of services or products acceptable to an organisation to achieve its objectives during a disruption.
• Recovery Point Objective (RPO): The maximum acceptable data loss measured in time prior to a disruption.
• Recovery Time Objective (RTO): The target time frame within the MTPD for resuming an activity at a specified capacity.
• Maximum Tolerable Period of Disruption (MTPD): The deadline beyond which the impacts of non-resumption become unacceptable.

What’s Next?

With costed solutions selected and approved by leadership, the organisation moves to Professional Practice 5: Enabling Solutions, turning these blueprints into live response plans and organisational capabilities.

• Next Step: Read PP5: Enabling Solutions – Turning Blueprints into Actionable Capabilities
• Previous Step: Read PP3: Analysis – The Blueprint of Priority

Disclaimer: These are independent study notes compiled to assist candidates preparing for the Certificate of the Business Continuity Institute (CBCI) examination. This content is not officially endorsed, sponsored, or affiliated with the Business Continuity Institute (BCI). The official body of knowledge is the BCI Good Practice Guidelines (GPG) Edition 7.0, which can be sourced directly from the BCI.