Drawing on the analysis of the results from the BIAs and in consideration of all the factors involved, the Business Continuity Manager can define the priorities for recovery of the IT and IS components. This assessment will be based upon the criticality of each process, the required RTOs and RPOs, restoration capability, the component/process location and component interdependencies. This is essential information since in turn it helps ICT and IS define their own staffing levels and resource requirements over time, in order to be able to support the recovery effort following an incident.
The end result will be a finalised recovery profile which shows over time what is being recovered and the specific resource (technical, staff, premises, equipment or materials) that is required at any time to support the recovery. The recovery profile will allow the identification of a number of possible recovery options; the choice of recovery option will determine the BCM strategy and subsequently the development of an appropriate IT Service Continuity Plan and the Business Continuity Plan.
Should discrepancies occur between the required process RTO and the component RTO, as highlighted in the IT Requirements Gap Analysis, these must be addressed before the BCP can be completed.