Business Continuity Plan

[COMPANY NAME]

Effective date: [DATE] · Owner: [NAME, TITLE] · Review: annually, or after any material change

Purpose

Every business has a continuity plan. Most of them live in one person’s head, and nobody finds out what is in it until that person is unreachable and the building has no internet.

This plan writes it down: what [COMPANY NAME] has to keep doing, how long it can be down before it hurts, and who decides what.

Scope

Applies to any disruption that stops people working normally — an outage, a failed system, a security incident, a supplier failure, losing access to the building, or losing a person the business depends on.

This plan covers keeping the business running. Restoring data is covered by the Backup and Recovery Policy. A security incident is run under the Incident Response Plan, and this plan covers what everyone else does while that happens.

Critical functions

Not everything is critical. Pretending otherwise produces a plan nobody can execute.

List only the functions the business cannot stop doing for long, and how long each can actually be down before it costs money, customers or a contract.

Where the third column comes from is its own exercise. The Business Impact Analysis works it out process by process — do that one first if these numbers would otherwise be a guess.

The fourth column is the one people skip. For each critical function, write down how it gets done with the system unavailable — on paper, by phone, from a personal device. If there is no answer, that is a finding, not a blank.

Dependencies

Most small business outages are somebody else’s outage. Record what you depend on and who to call.

Who decides

One named person declares a disruption and one named person stands it down. Without that, everyone waits for someone else.

Declares: [NAME, TITLE] · Alternate: [NAME, TITLE]

Authorized to spend in a disruption, up to [AMOUNT]: [NAME, TITLE]

Speaks to customers: [NAME, TITLE]

Speaks to press or posts publicly: [NAME, TITLE] — and nobody else

The alternate matters more than the primary. Disruptions do not wait for people to be available.

Reaching each other

If email is down, an email telling everyone email is down is not a plan.

[COMPANY NAME] maintains an out-of-band contact list — personal mobile numbers for every employee and the dependencies listed above — held outside the company systems it is meant to survive. Printed, and on [POLICY OWNER]‘s phone.

Agreed fallback channel: [CHANNEL]. Everyone knows to check it without being told.

Order of recovery

When several things are broken, the order is decided in advance, not argued about at the time. Recovery follows the max-tolerable-downtime column above — shortest first — unless [NAME, TITLE] decides otherwise and says why.

Write the first hour down:

1. Confirm what is actually affected, and whether it is a security incident. If it is, stop and run the Incident Response Plan.
2. Declare the disruption and name who is running it.
3. Notify staff on the out-of-band channel.
4. Start the manual workarounds above.
5. Contact the relevant dependency above.
6. Decide who tells customers, and what they are told.

Working somewhere else

If the building is unusable, staff work [FROM HOME / FROM ALTERNATE LOCATION]. The plan records what that requires — laptops, network access, phones diverted to [NUMBER], and who holds the keys or codes.

Natural disasters are the case where people’s safety comes first and the plan comes second. Account for everyone before restoring anything.

Insurance

[COMPANY NAME] holds [POLICY TYPES] with [CARRIER], policy number [NUMBER].

Most policies require prompt notification, and some require it before you engage your own vendors. Notify early — a claim is easier to withdraw than to reopen. The carrier’s incident line is recorded in the dependency table above.

Testing

A plan that has never been exercised is a document.

At least annually, [POLICY OWNER] runs a tabletop exercise — an hour, around a table, walking one realistic scenario through this plan. Record the date, who attended, the scenario, what did not work, and what changed as a result.

The output of the exercise is the edits it forces to this plan. An exercise that changes nothing was not honest enough.

Responsibilities

[POLICY OWNER] maintains this plan, the contact list and the exercise record.

Business owner approves the tolerable downtimes and what is spent to meet them.

Managers know the manual workarounds for their own function.

Everyone knows who declares a disruption and which channel to check.

Review

Reviewed at least annually by [POLICY OWNER], after any exercise, after any real disruption, and whenever a dependency in that table changes.

Template provided free by Cybertitans LLC, Woodbury, Minnesota. It is a starting point, not legal advice, and it has not been reviewed against your contracts, your industry’s regulations or your retention obligations. Have counsel review it before you adopt it. Downloading or using this template does not create a client relationship with Cybertitans, and Cybertitans makes no representation that adopting it satisfies any insurer, regulator, auditor or customer requirement.