Explanation
The scope of the business continuity management system (BCMS) is the statement that defines the boundaries and applicability of the BCMS. It specifies which products, services, processes, locations, and organizational units are covered by the BCMS, as well as any exclusions or limitations. The scope should document and explain any exclusions, which are the products, services, or processes that are not within the scope of the BCMS. Exclusions may be justified for various reasons, such as:
The products, services, or processes are not critical to the organization's operations and objectives.
The products, services, or processes are already covered by other management systems or plans.
The products, services, or processes are outside the organization's control or influence.
The products, services, or processes are not relevant or applicable to the organization's context or needs.
However, the exclusions should not affect the organization's ability to provide products and services that meet the requirements and expectations of its interested parties. The exclusions should also not compromise the conformity of the BCMS with the requirements of ISO 22301, the international standard for business continuity management systems. The scope and the exclusions should be documented in a clear and concise manner, and communicated to all relevant stakeholders. The scope and the exclusions should also be reviewed and updated regularly to reflect the changing circumstances and needs of the organization. References:
ISO 22301:2019 - Security and resilience - Business continuity management systems - Requirements, Clause 4.3: Determining the scope of the business continuity management system1 ISO 22301 Auditing eBook, Chapter 3: Business Continuity Integration, Section 3.1: Business Continuity Integration Levels2 ISO 22301 Clause 4.3 Determining the Scope of the Business Continuity Management System3

Explanation
The collection of corporate information provides evidence on the state of organizational preparedness, as it allows the organization to assess its currentcapabilities, resources, and performance in relation to its business continuity objectives and requirements. Corporate information includes documents, records, data, and other types of information that are relevant to the organization's business continuity management system (BCMS).
By collecting and analyzing corporate information, the organization can identify its strengths, weaknesses, opportunities, and threats, and determine the gaps and areas for improvement in its BCMS. Corporate information also helps the organization to monitor and measure the effectiveness and efficiency of its BCMS, and to demonstrate its compliance with the ISO 22301 standard and other applicable regulations and standards. References: ISO 22301 Auditing eBook, page 34; ISO 22301:2019 standard, clause 9.1

Explanation
Strategy option evaluation and selection is the strategy that supports the recovery needs of each critical product and service. This strategy involves the following steps:
Identify the recovery options: Based on the results of the business impact analysis (BIA) and the risk assessment, identify the possible recovery options for each critical product and service. Recovery options are the alternative ways of resuming the delivery of the product or service within the recovery time objective (RTO) and the recovery point objective (RPO). Examples of recovery options are:
relocating to an alternate site, activating a mutual aid agreement, using a cloud-based backup, outsourcing to a third-party provider, etc.
Evaluate the recovery options: Assess the feasibility, effectiveness, and efficiency of each recovery option, using criteria such as: cost, availability, scalability, compatibility, security, compliance, etc.
Compare the advantages and disadvantages of each option and rank them according to their suitability for meeting the recovery needs.
Select the recovery options: Choose the best recovery option for each critical product and service, based on the evaluation results and the available resources. Ensure that the selected option aligns with the organization's business continuity objectives, policies, and strategies. Document the rationale and justification for the selection and communicate it to the relevant stakeholders.
Strategy option evaluation and selection is the strategy that supports the recovery needs of each critical product and service, as it enables the organization to identify, evaluate, and select the most appropriate recovery option for each critical product and service, based on the BIA and the risk assessment results. This strategy helps the organization to ensure the continuity and resilience of its critical products and services in the event of a disruption, and to optimize the use of its resources and capabilities. References:
ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.4.2:
Business Continuity Strategy, Page 19
ISO 22301 Auditing eBook, Chapter 5: Business Continuity Management System Audit Activities, Section 5.3.2: Audit of Business Continuity Strategy, Page 37 ISO 22301:2019, Clause 8.3: Business Continuity Strategies and Solutions, Page 18