A business continuity plan (BCP) sets out how your company keeps its most important
work going, or gets it back quickly, when something disrupts it: a fire or flood, an IT failure or cyber attack, a
key supplier going under, or losing key people at once. This free Word template is built for companies of roughly
10 to 250 people.
It covers the business impact analysis, the incident team, a first-hour checklist, recovery steps for premises,
people, IT and suppliers, communications, and testing.
What's in the template
Business continuity plan
Company
Plan owner
Version
1.0
Approved by
Date approved
Next test
Copies kept
Include one offline copy, e.g. printed or on a phone
1. Purpose and scope
Which sites, teams and services this plan covers, and what it doesn't.
2. Incident team
Role
Name
Mobile
Deputy
Incident lead
Communications
IT and data
People and HR
Premises
Finance
3. Critical activities (business impact analysis)
Activity
Impact if it stops
Maximum tolerable outage
Recovery time objective
Minimum resources
Depends on
4. Scenarios
Scenario
Likelihood
Impact
Response in section
Loss of office or site (fire, flood, no access)
IT failure or cyber attack
Loss of key people (illness, resignation)
Key supplier fails
Power, internet or phone outage
5. First-hour checklist
Make sure everyone is safe and accounted for; call the emergency services if needed
Incident lead takes charge and starts the incident log (section 10)
Work out which critical activities are affected (section 3)
Decide whether to invoke this plan
Tell staff what to do: work from home, stay away, or carry on
If systems are affected, call IT support and don't switch off or wipe anything yet
Tell customers and suppliers if service is affected (section 7)
Record every decision and the time it was made
6. Recovery
Resource
If it's lost
Recovery steps
Owner
Premises
People
IT systems and data
Phones and internet
Key suppliers
Records
7. Communications
Audience
Message owner
Channel
When
Staff
Customers
Suppliers
Insurer
Bank
Regulators, if any
8. Key contacts
Organisation
Purpose
Contact
Account or policy no.
Insurer
IT support
Landlord or facilities
Bank
Utilities
9. Testing and review
Test
How often
Last done
Next due
Check contact details
Quarterly
Restore a backup
Tabletop exercise
Yearly
Full plan review
Yearly, and after any major change
10. Incident log
Time
Event or decision
By
The terms in the template
Business impact analysis (BIA): working out which activities matter most and how quickly the damage
grows when they stop.
Maximum tolerable outage: how long an activity can stop before the damage becomes unacceptable.
Recovery time objective (RTO): the target time to get an activity running again, which must be shorter
than its maximum tolerable outage.
Recovery point objective (RPO): how much data you can afford to lose, measured in time since the last
good backup.
How to write the plan
List the critical activities and how fast it hurts when each one stops.
Set a recovery target for each, and check your backups and suppliers can actually meet it.
For each scenario, decide the workaround in advance: laptops and cloud systems so people can work from
home, a second supplier, a phone divert.
Name the incident team and their deputies, collect the contacts, and keep a copy somewhere that will
still work if your systems don't.
Test it. An hour-long tabletop exercise with a realistic scenario finds most of the gaps.
Review it once a year and after any real incident.
Example: impact analysis for a fictional logistics company
How section 3 might look for a
120-person logistics firm:
Activity
Impact if it stops
Recovery target
Minimum resources
Dispatching customer orders
Missed deliveries; contract penalties after a day
8 hours
Warehouse system, 6 staff, courier booking
Customer service phones
Customers can't reach us; complaints
2 hours
Divert to mobiles, 3 staff
Payroll
Staff not paid on payday
3 days before payday
Payroll system, 1 trained person
Supplier payments
Late fees; strained suppliers
5 days
Banking access, 2 approvers
Common mistakes
A plan that only covers IT. Losing a building, a supplier or two key people can hurt as much.
Out-of-date contact details, which you only find out in the middle of an incident.
The only copy is on the server that's down.
Never tested, so nobody knows their role.
No deputies. The incident lead may be the one who's unavailable.
Frequently asked questions
What's the difference between a business continuity plan and a disaster recovery plan?
A disaster recovery plan covers getting IT systems and data back. A business continuity plan covers the whole business: people, premises, suppliers and customers as well as IT.
Is a business continuity plan a legal requirement?
For most private companies it isn't, but customers, insurers and regulators often ask to see one, and some contracts require it.
How often should we test it?
Check the contact details every few months and run at least one exercise a year. Test backups by actually restoring from them.