Explanation
Strategy option evaluation and selection is the strategy that supports the recovery needs of each critical product and service. This strategy involves the following steps:
Identify the recovery options: Based on the results of the business impact analysis (BIA) and the risk assessment, identify the possible recovery options for each critical product and service. Recovery options are the alternative ways of resuming the delivery of the product or service within the recovery time objective (RTO) and the recovery point objective (RPO). Examples of recovery options are:
relocating to an alternate site, activating a mutual aid agreement, using a cloud-based backup, outsourcing to a third-party provider, etc.
Evaluate the recovery options: Assess the feasibility, effectiveness, and efficiency of each recovery option, using criteria such as: cost, availability, scalability, compatibility, security, compliance, etc.
Compare the advantages and disadvantages of each option and rank them according to their suitability for meeting the recovery needs.
Select the recovery options: Choose the best recovery option for each critical product and service, based on the evaluation results and the available resources. Ensure that the selected option aligns with the organization's business continuity objectives, policies, and strategies. Document the rationale and justification for the selection and communicate it to the relevant stakeholders.
Strategy option evaluation and selection is the strategy that supports the recovery needs of each critical product and service, as it enables the organization to identify, evaluate, and select the most appropriate recovery option for each critical product and service, based on the BIA and the risk assessment results. This strategy helps the organization to ensure the continuity and resilience of its critical products and services in the event of a disruption, and to optimize the use of its resources and capabilities. References:
ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.4.2:
Business Continuity Strategy, Page 19
ISO 22301 Auditing eBook, Chapter 5: Business Continuity Management System Audit Activities, Section 5.3.2: Audit of Business Continuity Strategy, Page 37 ISO 22301:2019, Clause 8.3: Business Continuity Strategies and Solutions, Page 18

Explanation
The media and press have a profound impact on the long-term performance, or in some cases, the survival of an organization, especially in the aftermath of a disruptive incident. The media and press can influence the perception and reputation of the organization, as well as the expectations and satisfaction of its stakeholders, such as customers, suppliers, regulators, employees, and the general public. Therefore, it is important for the organization to establish and maintain a positive relationship with the media and press, and to communicate effectively and transparently during and after a crisis. ISO 22301:2019, Clause 8.4.3, requires the organization to establish, implement, and maintain a documented procedure to manage communications with relevant interested parties during a disruptive incident. The procedure should include the identification of the spokesperson(s) who will communicate with the media and press, the preparation of key messages and statements, the approval and distribution of information, and the monitoring and evaluation of the effectiveness of the communications. The organization should also consider the potential legal andethical implications of its communications, and ensure that the information provided is accurate, consistent, and timely. References: ISO 22301:2019, Clause 8.4.3; ISO 22301 Auditing eBook, Chapter 4.3.3.