> ## Content Index > Fetch the complete content index at: https://paulobrien.com/llms.txt > Use this file to discover other available public pages before exploring further. # PP4: Solutions Design - URL: https://paulobrien.com/pp4-solutions-design/ - Published: 2026-08-25T15:38:08.000Z - Updated: 2026-08-25T17:47:42.000Z - Description: Part 4 of 6 in my CBCI study series. A practical breakdown of BCI GPG 7.0 PP4: Solutions Design—moving from identifying resource gaps to designing cost-effective strategies, selecting recovery solutions, and resolving single points of failure. - Author: Paul O'Brien - Tags: CBCI Study Series, PP4: Solutions Design ## CBCI Study Series · Professional Practice 4 of 6 BCI Good Practice Guidelines (GPG 7.0) ### Designing the Escape Hatch: A Study Guide to BCI PP4 (Solutions Design) Introduction: My Journey from 'Knowing the Gaps' to 'Building the Bridges' In my previous post on [PP3: Analysis](https://paulobrien.com/tag/pp3-analysis/), we learned how to systematically calculate an organisation's business continuity requirements. We calculated Maximum Tolerable Periods of Disruption (MTPDs), defined strict Recovery Time Objectives (RTOs), set Recovery Point Objectives (RPOs) for database back-ups, and exposed dangerous Single Points of Failure (SPOFs). But as I progressed through the BCI syllabus, I hit a massive conceptual bridge. Knowing that a system is vulnerable or that an activity has a 4-hour RTO is not a capability—it is merely a documented gap. How do we actually design the strategic options, resource arrangements, and technical frameworks necessary to cross that chasm? That is the precise role of PP4: Solutions Design. In my study journey, realising that Solutions Design is about creating multiple cost-effective, practical escape routes was a major 'aha!' moment. Here are my core, exam-focused study notes to help you master this vital Technical Practice and ace your CBCI exam. 🚨 ****EXAM TRAP ALERT: The 'Strategy' vs. 'Solution' Distinction** In GPG Edition 7.0, the BCI officially evolved this practice's name from 'Business Continuity Strategy' to 'Solutions Design' (or 'Business Continuity Recovery Strategies and Solutions'). The exam heavily tests your understanding of the relationship between these two terms: • Strategy: The high-level approach or strategic path selected to meet the continuity requirements (e.g., 'Relocate staff to an alternate facility'). • Solution: The tactical action, specific contract, technical arrangement, or procedure that actually delivers that strategy (e.g., 'A pre-arranged contract with a commercial serviced office provider to supply 50 desks within 24 hours'). Remember: A strategy should consist of at least one solution, and a single solution can support multiple strategies. #### 1\. From Requirements to Reality: The Three-Step Solutions Design Process Under GPG 7.0, designing continuity strategies and solutions is not a creative free-for-all. It is a highly structured, three-step process that you must execute in sequence: - Step 1: Gap Analysis. Before designing anything, the BC Professional must perform a Gap Analysis. This process establishes whether current-state recovery capabilities (the actual time and capacity the organisation can currently muster) actually meet the formal requirements approved by senior management in PP3\. The BC Professional achieves this by meeting with the owners of prioritised activities and resources—sequenced in order of shortest to longest RTO—to evaluate their current readiness levels. - Step 2: Strategy Determination. Once the gaps are exposed, the BC Professional groups the activities and resources by owner and RTO. You then facilitate collaborative planning sessions with the owners to brainstorm alternate strategies to close those gaps. For every strategic option developed, the owner must document key parameters: a detailed technical specification, advantages and disadvantages, implementation lead-time, and estimated costs to prepare, implement, operate, and maintain. - Step 3: Solutions Design & Selection. This final step requires the involvement of a broader range of personnel, offering a perfect opportunity to strengthen the practice of Embracing BC (PP2). Once detailed solutions are designed to deliver the strategies, the completed specifications and cost-benefit profiles are presented directly to Top Management. Only Top Management has the strategic authority to select, approve, and fund the final solutions. #### 2\. Shifting the Burden: Activity Strategies vs. Resource Strategies For the exam, you must understand that the GPG categorises strategy developers into two distinct groups: • Activity Owners: These individuals possess deep, practical knowledge of the underlying business processes and are responsible for resuming activities. Their strategies dictate how the \*work\* gets done during a disruption. • Resource Owners: These individuals ensure the delivery of the organisation's physical and digital assets. They are responsible for the repair, replacement, and restoration of physical resources (IT, facilities, equipment) to support the activity owners. Crucially, activity-level strategies must guide resource-level strategies and solutions. For example, if an activity owner decides their recovery strategy is to relocate a process to an alternate site, this immediately triggers resource owners to design corresponding solutions for IT systems, workspace, staff transportation, and physical security at that alternate site. #### 3\. Categorising Recovery: The Platinum, Gold, and Silver Tiering System To avoid design chaos, GPG 7.0 recommends grouping strategies based on predefined RTO ranges. This allows organisations to standardise their recovery architectures rather than designing bespoke solutions for hundreds of separate systems. Common categorisation models include Platinum/Gold/Silver/Bronze or Tiers 1-4\. By setting these standard tiers, the organisation can align recovery speeds with solution complexity and cost: - • Platinum Tier (RTO < 2 Hours): Reserved for highly critical, near-zero disruption activities. These require the most advanced, sophisticated, and expensive solutions, such as active/active real-time server replication, continuous dual-routing communications, and immediate on-site backup utilities. - • Gold Tier (RTO 2-12 Hours): Requires highly responsive solutions, such as warm standby servers pre-loaded with recent backup restores, pre-trained on-site deputy teams, and work-from-home capabilities. - • Silver/Bronze Tier (RTO > 12 Hours to Weeks): Can rely on more cost-effective, passive, or 'purchase when needed' solutions, such as cold recovery database restoration, sourcing general contract staff, or purchasing equipment on the open market post-disruption. #### 4\. Solving the Resource Puzzle: GPG 7.0 Strategy Toolkits During solutions design, the GPG provides comprehensive 'strategy toolkits' across different resource types. These outline standard industry solutions and the necessary prerequisites that must be implemented \*before\* a crisis occurs. The table below synthesises the GPG 7.0 toolkits for three of the most highly tested resource domains: | Resource Type | Sample Strategy | Typical Solution (PP4) | Key Prerequisite (Pre-Crisis) | | ----------------------------- | -------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | | **People** | Cross-Training & Delegated Authority | Assign staff with suitable competency from non-impacted sites, or promote junior staff to higher duties. | Maintain active training materials and formally document delegated authority triggers. | | **IT Systems & Applications** | Hot Continuity vs. Warm Recovery | Active/active server replication across distinct sites (Hot), or warm standby ready for latest restore (Warm). | Install diverse network routing, establish backup servers, and test restoration scripts. | | **Suppliers & Supply Chain** | Multi-Sourcing vs. Operational Step-In | Engage dual active suppliers, or step in to offer equipment, funding, or staff to help a key supplier recover. | Integrate continuity clauses into SLAs, and pre-verify alternative suppliers' capacity. | A critical technique within the BC toolkit is the use of temporary workarounds. A workaround is a change to the way of operating that provides acceptable outcomes for a limited time. Although workarounds are often highly manual, labor-intensive, and expensive, they provide two massive benefits: they enable an activity to recover \*before\* the primary technology RTO is reached, and they can successfully extend the RTO of a resource by buying the IT team more recovery time. #### 5\. Eradicating SPOFs: Mitigating Unacceptable Risks and Single Points of Failure The second major objective of PP4 is specifying strategies and solutions to mitigate unacceptable risks and eliminate Single Points of Failure (SPOFs) exposed during the Risk Assessment (PP3). This involves collaborating directly with risk, facilities, and technology owners to design preventive treatments. Under ISO 31000 and BCI guidelines, risk treatments must either seek to reduce the likelihood of a disruption occurring (prevention) or lower the impact when it does occur (recovery solutions). However, GPG 7.0 notes that the identification of risk solutions is heavily bounded by five critical business considerations: - 1\. Regulatory Obligations: Selected solutions must never breach statutory requirements. - 2\. Cost-Benefit Constraints: The cost of implementing and operating a risk solution must not exceed the estimated cost of the disruption itself. - 3\. Intangible Benefits: Organisations must factor in non-financial returns, such as public trust and reputation. - 4\. Secondary Risks: A recovery solution must never introduce additional, unmanaged risks into the business. - 5\. Risk Appetite: The solution must align with senior management's established risk tolerance. #### Test Your Knowledge: BCI Exam Prep PP4 Quiz **Question 1** **Under BCI GPG Edition 7.0, what is the correct relationship between a business continuity recovery 'strategy' and a recovery 'solution'?** A) A strategy is a technical IT restore plan, while a solution is a business-level workaround. B) A strategy defines the high-level approach to meet requirements, while a solution details the specific arrangements, procedures, and actions to deliver that strategy. C) A strategy is legally binding under ISO 22301, whereas a solution is entirely voluntary. D) A strategy must be designed by Top Management, while a solution is designed strictly by external consultants. #### Answer ****Correct Answer: B** ****Explanation**: Under GPG 7.0, a 'strategy' represents the high-level path or approach to meeting business continuity requirements (e.g., relocating staff). A 'solution' is the specific arrangement, contract, or action that implements that strategy (e.g., a contract for a warm standby serviced office). A strategy should consist of at least one solution. **Question 2** **During the Solutions Design phase of the BCMS, which role is responsible for the restoration, repair, and replacement of physical and technical resources (such as ICT systems and facilities) to support prioritised activities?** A) The Activity Owner B) The Departmental Representative C) The Resource Owner D) The External Auditor #### Answer ****Correct Answer: C** ****Explanation**: The GPG distinguishes between Activity Owners (who understand the process and are responsible for resuming the underlying activities) and Resource Owners (who are responsible for the repair, replacement, and delivery of the physical and technical resources like IT, facilities, and equipment). **Question 3** **An organisation's critical database has an RTO of 4 hours. The business unit designs a manual workaround where staff record orders on paper and manually upload them to a backup system every 4 hours once it recovers. What is a key benefit of this workaround according to PP4?** A) It permanently eliminates the need to recover the main database. B) It successfully extends the RTO of the database resource by providing a temporary, acceptable operating method. C) It guarantees zero financial cost during a live disruption. D) It satisfies the ISO requirement to completely eliminate all secondary risks. #### Answer ****Correct Answer: B** ****Explanation**: A key benefit of a temporary workaround is that it can extend the RTO of a technical resource. By using a manual process to continue business operations at an acceptable capacity, the organisation can tolerate the main technical resource being offline for a longer period of time. **Question 4** **When grouping business continuity strategies into RTO-based categories (such as Platinum, Gold, and Silver Tiers), which of the following is correct regarding the design and cost of these strategies?** A) Silver Tier strategies represent the most expensive and complex recovery solutions. B) All tiers must have identical implementation costs and timeframes. C) Platinum Tier strategies represent the most urgent recovery capability and require the most advanced, sophisticated, and expensive solutions. D) Only Bronze Tier strategies are formally approved by Top Management. #### Answer ****Correct Answer: C** ****Explanation**: Category A or 'Platinum' tier represents the most urgent, immediate recovery capability (RTOs within minutes or hours). Because they require continuous availability and immediate recovery, they rely on highly sophisticated, replicated, and expensive solutions (like active/active server replication). **Question 5** **When evaluating risk treatment solutions to mitigate unacceptable risks and Single Points of Failure (SPOFs) identified in the Risk Assessment, which of the following must the BC Professional ensure?** A) The solution must completely eliminate the risk regardless of cost. B) The cost of the mitigation solution must not exceed the estimated cost of the disruption itself, and the solution must not introduce a secondary risk. C) The solution should only address IT-related single points of failure. D) The solution must be implemented without consulting the activity owners. #### Answer ****Correct Answer: B** ****Explanation**: GPG PP4 explicitly mandates that the cost of mitigating a disruption should not exceed the cost of the disruption itself, and that any selected solution must be checked to ensure it does not introduce a secondary, unmanaged risk to the organisation. ## 📬 Never Miss a Deep Dive I’m breaking down the entire BCI Good Practice Guidelines (GPG 7.0) step-by-step as I prepare for the CBCI exam. If you want practical resilience breakdowns and study notes delivered straight to your inbox as they publish, subscribe below—100% free, zero spam. Subscribe Email sent! Check your inbox to complete your signup. No spam. Unsubscribe anytime. **What's Next? Moving into Implementation & Plans** With our strategies thoroughly designed, cost-evaluated, and formally approved by Top Management, we have officially finished the 'design' phase of our business continuity journey. But a set of approved specifications on a strategy board cannot save an organisation during a live crisis. To turn those designs into active, operational capabilities, we must transition to the next technical practice: **Professional Practice 5 (PP5): Enabling Solutions**. In our next post, we will explore how we run implementation projects, design robust Incident Response Team (IRT) structures across strategic, tactical, and operational levels, and compile actionable, high-pressure business recovery playbooks. Stay tuned, and keep building those bridges! **Next in the series:**[(PP5): Enabling Solutions](https://paulobrien.com/pp5-enabling-solutions/) 📚 New to the series? Start from the beginning or jump to any chapter by visiting the [CBCI Study Series Index](https://paulobrien.com/journey-to-cbci-business-continuity-gpg-7-0/) and don’t forget to grab your copy of the companion [GPG 7.0 Glossary Study Guide](https://paulobrien.com/bci-gpg-edition-7-0-complete-glossary/)! --- *Disclaimer: These are independent study notes compiled to assist candidates preparing for the Certificate of the Business Continuity Institute (CBCI) examination. This content is not officially endorsed, sponsored, or affiliated with the Business Continuity Institute (BCI). The official body of knowledge is the BCI Good Practice Guidelines (GPG) Edition 7.0, which can be sourced directly from the BCI.*