Guides
Writing a business continuity plan: a step-by-step guide
How to write a business continuity plan: impact analysis, recovery times, plans for people, sites, IT and suppliers, testing, and how it fits your insurance.
A business continuity plan (BCP) is a written plan for keeping your critical operations running, or getting them back fast, after something stops them: a fire, a flood, a ransomware attack, a supplier failure, a power outage, the loss of a key person. You build it by finding out which functions the business cannot do without, deciding how quickly each must return, choosing a way to deliver each one without the usual site, system or supplier, writing the steps down with names and phone numbers, and testing it. The insurance you carry, starting with business interruption insurance: how business income coverage works, pays for part of the recovery. The plan decides how long recovery takes.
Where the BCP fits among your other plans
Ready.gov, the preparedness site run by FEMA, lists four plans a business should have, and they are easy to confuse.
| Plan | What it answers | Time frame |
|---|---|---|
| Emergency response | How do people get out, shelter or lock down, and who calls 911? | First minutes |
| Crisis communications | Who tells employees, customers, regulators and the press what, and when? | First hours and days |
| IT disaster recovery | How are systems, applications and data restored? Ready.gov says it should be developed together with the continuity plan | Hours to days |
| Business continuity | How does the business keep delivering, or resume delivering, its critical functions? | Days to months |
This guide covers the last one. The first is covered in disaster preparedness for small businesses: a practical checklist, and the technology side of a cyber event in the building an incident response plan your insurer will like guide.
Ready.gov's continuity guidance runs through six steps: prepare, define objectives, identify and prioritize risks and impacts, develop strategies, define teams and tasks, and test the plan. The structure below follows that path with more detail on the parts that decide the insurance outcome. For companies that want a formal management system, the international standard is ISO 22301 (2019 edition, amended in 2024), which organizations can be certified against; most small businesses do not need certification, but customers in some supply chains ask for it.
Step 1: set scope and name the team
Decide what the plan covers (one site or all, the whole company or critical functions only) and who owns it. Name a continuity lead with authority to spend, a deputy, and a representative for each function: operations, IT, finance, HR, sales and facilities. In a ten-person firm that is three or four people wearing several hats. The point is that every task has a name next to it, and every name has a backup.
Step 2: run a business impact analysis
The business impact analysis (BIA) is the foundation, and it complements the exposures you list in a how to build a risk register. Ready.gov describes it as predicting the consequences of a disruption and gathering the information needed to develop recovery strategies, and it says processes with the greatest operational and financial impact should be restored first. For each function, record:
- What it delivers and to whom, including contractual deadlines and penalties.
- What it depends on: people, a site, equipment, software, data, suppliers, utilities and outside service providers.
- What happens to revenue, cost, compliance and customers after 4 hours, a day, three days, a week and a month.
- Seasonal peaks. An outage in the peak week costs more than one in the slow week.
Interview the people who do the work. They know the spreadsheet only one person understands, the single supplier, and the process that cannot run without a particular printer.
Step 3: set recovery objectives
Two terms from the trade help.
- Recovery time objective (RTO): how soon a function must be running again after an interruption.
- Recovery point objective (RPO): how much data you can afford to lose, measured as time. A nightly backup means an RPO of up to 24 hours.
Shorter objectives cost more, so tie them to the BIA. Order intake that brings in 40% of revenue may justify a four-hour RTO. Back-office reporting can wait two weeks. Write the objectives next to each function and have the owner approve them.
Step 4: pick strategies for each dependency
| Dependency | Typical strategies |
|---|---|
| People | Cross-train two people per critical task; documented procedures; remote work capability; call tree; succession for the owner and key managers (see key person insurance: protecting the business from a loss of talent) |
| Site | Alternate location or reciprocal agreement; remote operation; shared or temporary space; a mobile unit |
| Technology | Cloud hosting; backups with an offline or immutable copy; periodic restore tests; spare hardware or a vendor with fast replacement terms |
| Suppliers | Second source for critical inputs; safety stock; contract terms on delivery and notice; knowledge of your suppliers' own suppliers |
| Records | Offsite and digital copies of leases, contracts, insurance policies, customer files and employee records; see valuable papers and records |
| Utilities | Generator or battery backup for critical systems; a second internet provider; knowing which gas, power and water shutoffs are where |
| Cash | A line of credit, a payroll plan for the first two pay cycles, a list of who can sign |
Some strategies are free (cross-training, a second quote from a vendor) and some are expensive (a hot site). Spend where the BIA shows the largest loss per day.
Step 5: write the plan
A usable plan is short enough to be read at 2 a.m. Include:
- Purpose, scope and the activation criteria: who may declare an event and what triggers it.
- The team roster with mobile numbers, personal email, and backups.
- The critical function list with RTO, RPO and the recovery strategy for each.
- Step-by-step recovery checklists per function.
- Contact lists: employees, customers, key suppliers, landlord, bank, utilities, IT provider, attorney, insurance broker and the claim reporting numbers for every policy.
- Locations of backups, keys, password vaults (not the passwords themselves) and the alternate site.
- Communication templates for employees, customers and the press.
- A copy of the insurance schedule: carriers, policy numbers, limits, deductibles, waiting periods.
Keep copies off the system you are planning to lose. Print some and store the file somewhere reachable from a phone.
Step 6: test it
Run a tabletop exercise once a year: an hour with the team and a scenario ("the building is closed for six weeks; where do we work Monday?"). Test the pieces: call the call tree and see who answers; restore a file from backup; place a test order with the alternate supplier; run payroll from the alternate setup. Write down what failed and fix it. Update the plan after any significant change in staff, systems, location or supplier.
Hypothetical worked example
Say a 30-employee e-commerce fulfillment business in Georgia, with $12 million in annual sales, runs a leased warehouse and a cloud-based store and order system. A fire could close the warehouse for months. The BIA finds:
| Function | Dependencies | RTO | Strategy |
|---|---|---|---|
| Order intake and payments | Cloud store, payment provider | 4 hours | Hosted platform; second payment gateway; tested restore |
| Picking and shipping | Warehouse, inventory, carriers | 48 hours | Standing agreement with a third-party fulfillment provider |
| Customer service | Phones, helpdesk software | 24 hours | Staff forward calls to mobile; script for delay messages |
| Payroll | Accounting software, bank | 5 days | Payroll service with remote access; cash reserve for two pay cycles |
On the insurance side, say annual net income is $600,000 and continuing expenses including payroll are $3.4 million. business income exposure is about $4.0 million ÷ 365, or $11,000 a day. The standard ISO business income form (CP 00 30, 10 12 edition) applies a 72-hour waiting period to business income, so roughly $33,000 falls to the business before coverage starts, while extra expense begins immediately. A 30-day shutdown puts $330,000 of income at risk, which the business income (interruption) limit calculator and the guide on how to calculate a business income limit can test against the limit. The example is hypothetical; the form on your own policy may differ.
Where the plan and the policy meet
- Sizing the limit. The BIA gives you a defensible estimate of business income, extra expense and the realistic rebuild time. That is better evidence than a guess at renewal.
- Period of restoration. Insurance pays for the time needed to repair or replace the property with reasonable speed, which may be shorter than the time to get permits, long-lead equipment or customers back. Ask about an extended period of indemnity or extended business income. The standard form's extended business income runs 60 days.
- Duty to resume. The standard form reduces the business income loss to the extent you can resume operations, in whole or in part, at the premises or elsewhere. A plan that gets you running at an alternate site helps the business and is consistent with what the form expects. Extra expense for temporary space and expediting is what pays for it, so keep the receipts.
- Dependencies. A supplier or customer outage may be covered only if you bought contingent business interruption insurance and supply chain risk, and a power outage only with utility service interruption coverage. Flood and earthquake need their own coverage.
- Cyber. A ransomware shutdown is a business interruption, but under a cyber policy, with its own waiting period and terms. See cyber business interruption and dependent system failure.
Key takeaways
- A business continuity plan names the functions you must keep, how fast each must return and how you will do it without the usual site, system or supplier.
- The business impact analysis drives everything: it gives the loss per day, the recovery times and the evidence for your insurance limits.
- Test the plan at least once a year and update it after any change in people, systems, locations or suppliers.
- The standard business income form has a 72-hour waiting period and expects you to resume operations when you can, so plan the first days without insurance money.
- Keep a copy of the plan, the insurance schedule and the claim numbers off the systems you are planning to lose.