According to the CCAK Study Guide, the business continuity management and operational resilience strategy of the cloud customer should be formulated jointly with the cloud service provider, as they share the responsibility for ensuring the availability and recoverability of the cloud services. The strategy should cover all aspects of business continuity and resilience planning, taking inputs from the assessed impact and risks, to consider activities for before, during, and after a disruption. These activities include prevention, mitigation, response, recovery, restoration, and improvement. The strategy should also define the roles and responsibilities of both parties, the communication channels and escalation procedures, the testing and exercising plans, and the review and update mechanisms1
The other options are not correct because:
Option B is not correct because the strategy should not only be developed within the acceptable limits of the risk appetite, but also aligned with the business objectives and stakeholder expectations of both parties. The risk appetite is only one of the factors that influence the strategy formulation1
Option C is not correct because the strategy should not only cover the activities required to continue and recover prioritized activities within identified time frames and agreed capacity, but also consider the activities for before and after a disruption, such as prevention, mitigation, improvement, etc. The strategy should also include other elements such as roles and responsibilities, communication channels, testing plans, etc1
References: 1: ISACA, Cloud Security Alliance. Certificate of Cloud Auditing Knowledge (CCAK) Study Guide. 2021. pp. 83-84.
