IT Service Continuity strategy should be based on: (1) Design of the service technology (2) Business continuity strategy (3) Business Impact Analysis (4) Risk assessment

This excludes Business Impact Analysis, which is essential for determining recovery priorities and defining the minimum service levels required during a disruption.

This excludes risk assessment, which is required to identify, evaluate, and prioritize threats that the continuity strategy must be designed to mitigate.

The business continuity strategy provides the overarching framework that IT continuity plans must support. Business Impact Analysis identifies which services are critical and establishes recovery time and point objectives. Risk assessment identifies the threats and vulnerabilities the strategy must address. The design of the service technology is an input to service design, not a strategic basis for continuity planning.

This excludes business continuity strategy, which provides the mandatory overarching framework that all IT Service Continuity planning must align with and support.