IT Service Continuity strategy should be based on: (1) Design of the service technology (2) Business continuity strategy (3) Business Impact Analysis (4) Risk assessment

Service technology design is not a required ITSCM strategy input because technology design should follow from continuity requirements, not precede or define them.

Including service technology design while excluding risk assessment omits a mandatory ITSCM input and produces a strategy that is not grounded in threat and vulnerability analysis.

ITIL specifies that the IT Service Continuity strategy must align with and directly support the overall Business Continuity Strategy so that IT recovery objectives match business recovery objectives. The Business Impact Analysis identifies critical business processes and the IT services that underpin them, establishing recovery time and recovery point objectives. The Risk Assessment identifies threats and vulnerabilities that could disrupt those services, ensuring the ITSCM strategy is both business-driven and risk-informed rather than driven by technical architecture.

Excluding the business continuity strategy severs the required alignment between IT continuity planning and the overarching business continuity objectives that IT must support.