Compliance guide
Business Continuity Plan (BCP) Template
A business continuity plan (BCP) sets out how your business keeps running, and recovers, when something disrupts it: an IT outage, a cyber incident, losing premises or a key supplier. This guide gives you a free template, the key concepts (BIA, RTO, RPO), and a done-for-you option. After finished samples? See our business continuity plan examples.
Last updated
Key takeaways
- A BCP answers a simple question: if X happens tomorrow, how do we keep operating and recover?
- It's built on a business impact analysis (BIA), which identifies your critical activities and how quickly they must be restored.
- Two numbers drive it: RTO (how fast you must recover an activity) and RPO (how much data you can afford to lose).
- Disaster recovery (DR) is the IT-focused part of continuity; many businesses combine them into a BCDR plan.
- It's increasingly requested in tenders and security reviews, and the international standard is ISO 22301.
- Use the free template below, or have a tailored plan prepared for you.
What is a business continuity plan?
A business continuity plan (BCP) is a document that sets out how your business will continue its critical operations during, and after, a disruption, and how it will recover. Disruptions can be anything from a cyber attack or IT failure to a flood, power loss, supplier failure or losing access to your premises.
It goes by several names, business continuity plan, continuity of operations plan, business recovery plan, or just BCP, but they describe the same thing: a practical playbook for keeping the lights on when things go wrong.
Key concepts: BIA, RTO and RPO
Three ideas do most of the work in a good BCP:
- Business Impact Analysis (BIA), identifies your critical activities and the impact over time if they stop. It tells you what to prioritise.
- Recovery Time Objective (RTO), the maximum acceptable time to restore a critical activity after a disruption. "Orders must be back within 4 hours."
- Recovery Point Objective (RPO), the maximum acceptable amount of data loss, measured in time. An RPO of 1 hour means you back up at least hourly.
- Maximum Tolerable Period of Disruption (MTPD), the point beyond which the damage becomes unacceptable, your RTO must be shorter than this.
What to include: business continuity plan template structure
Adapt this outline to your business. Keep it usable under pressure, clarity beats length:
- Purpose and scope, what the plan covers and who it applies to.
- Roles and responsibilities, the continuity team and who does what in a disruption.
- Business impact analysis, your critical activities, with RTOs and RPOs.
- Risks and scenarios, the disruptions you're planning for (IT outage, cyber, premises, supplier, people).
- Continuity strategies, how you keep critical activities running (workarounds, alternate sites, remote work).
- Disaster recovery (IT), how systems and data are restored, backups, and recovery steps.
- Incident response and escalation, who's alerted and how decisions are made (links to your incident response policy).
- Communications, a call tree and how you reach staff, customers and suppliers.
- Recovery and return to normal, how you resume full operations.
- Testing and maintenance, how often you exercise and review the plan.
- Appendices, contacts, key suppliers, systems inventory and checklists.
Download the editable business continuity plan template
Pop your email in and we'll send the BCP template in Word and PDF, with a BIA table and a call tree ready to fill in.
How to build your business continuity plan
A workable plan comes from a few focused steps, not a giant document.
- 1
Identify critical activities
Run a simple business impact analysis: what must keep running, and how fast must it recover?
- 2
Set RTOs and RPOs
For each critical activity, agree a recovery time and acceptable data loss.
- 3
Assess your risks
List the disruptions most likely to hit you and the ones that would hurt most.
- 4
Decide your strategies
For each critical activity, work out how you'd keep it going or recover it, including IT/DR.
- 5
Write it down and assign roles
Capture it in the template, name the continuity team and build your call tree.
- 6
Test and review
Run a tabletop exercise, fix what didn't work, and review at least annually.
Free template vs done-for-you document
Happy to run your own BIA and fill in the plan? The free template covers it. Want it tailored, with your critical activities, RTOs and DR steps worked through? Here's the done-for-you option.
| Free template | Done-for-you document | |
|---|---|---|
| Price | £0 | Fixed fee |
| Effort from you | A day or two of work | A guided intake |
| Business impact analysis | You run it | Worked through with you |
| RTO/RPO and DR steps | You set them | Mapped for you |
| Tender / review ready | Format it yourself | Supplied as a clean PDF |
| If it needs changes | You redo it | We revise it free |
Prefer your business continuity plan done for you?
Tell us about your business and critical operations, and we'll prepare a tailored BCP, with a business impact analysis, RTOs and disaster recovery steps mapped for you.
Requests for the business continuity plan are reviewed and prepared manually, we'll follow up by email.