Compliance guide
Business Continuity Plan (BCP) Template
A business continuity plan (BCP) is the operational playbook: how your business keeps running, and recovers, when something disrupts it. This guide teaches the plan (BIA, RTO, RPO). What we can fill for you now is the signed policy that sits above it. A tailored playbook is a later product. After finished samples? See our business continuity plan examples.
Last updated
Key takeaways
- A BCP answers a simple question: if X happens tomorrow, how do we keep operating and recover?
- It's built on a business impact analysis (BIA), which identifies your critical activities and how quickly they must be restored.
- Two numbers drive it: RTO (how fast you must recover an activity) and RPO (how much data you can afford to lose).
- Disaster recovery (DR) is the IT-focused part of continuity; many businesses combine them into a BCDR plan.
- It's increasingly requested in tenders and security reviews, and the international standard is ISO 22301.
- Use this guide to learn the playbook. We can fill a signed policy for you now; a tailored plan is a later product.
What is a business continuity plan?
A business continuity plan (BCP) is a document that sets out how your business will continue its critical operations during, and after, a disruption, and how it will recover. Disruptions can be anything from a cyber attack or IT failure to a flood, power loss, supplier failure or losing access to your premises.
It goes by several names, business continuity plan, continuity of operations plan, business recovery plan, or just BCP, but they describe the same thing: a practical playbook for keeping the lights on when things go wrong.
Key concepts: BIA, RTO and RPO
Three ideas do most of the work in a good BCP:
- Business Impact Analysis (BIA), identifies your critical activities and the impact over time if they stop. It tells you what to prioritise.
- Recovery Time Objective (RTO), the maximum acceptable time to restore a critical activity after a disruption. "Orders must be back within 4 hours."
- Recovery Point Objective (RPO), the maximum acceptable amount of data loss, measured in time. An RPO of 1 hour means you back up at least hourly.
- Maximum Tolerable Period of Disruption (MTPD), the point beyond which the damage becomes unacceptable, your RTO must be shorter than this.
What to include: business continuity plan template structure
Adapt this outline to your business. Keep it usable under pressure, clarity beats length:
- Purpose and scope, what the plan covers and who it applies to.
- Roles and responsibilities, the continuity team and who does what in a disruption.
- Business impact analysis, your critical activities, with RTOs and RPOs.
- Risks and scenarios, the disruptions you're planning for (IT outage, cyber, premises, supplier, people).
- Continuity strategies, how you keep critical activities running (workarounds, alternate sites, remote work).
- Disaster recovery (IT), how systems and data are restored, backups, and recovery steps.
- Incident response and escalation, who's alerted and how decisions are made (links to your incident response policy).
- Communications, a call tree and how you reach staff, customers and suppliers.
- Recovery and return to normal, how you resume full operations.
- Testing and maintenance, how often you exercise and review the plan.
- Appendices, contacts, key suppliers, systems inventory and checklists.
Download the editable business continuity plan template
We'll email the Business Continuity Policy pack (Word template plus how-to). A playbook file is not included yet. Use the structure on this page to draft your own plan.
How to build your business continuity plan
A workable plan comes from a few focused steps, not a giant document.
- 1
Identify critical activities
Run a simple business impact analysis: what must keep running, and how fast must it recover?
- 2
Set RTOs and RPOs
For each critical activity, agree a recovery time and acceptable data loss.
- 3
Assess your risks
List the disruptions most likely to hit you and the ones that would hurt most.
- 4
Decide your strategies
For each critical activity, work out how you'd keep it going or recover it, including IT/DR.
- 5
Write it down and assign roles
Capture it in the template, name the continuity team and build your call tree.
- 6
Test and review
Run a tabletop exercise, fix what didn't work, and review at least annually.
Free playbook guide vs done-for-you policy
This page teaches the operational playbook. What we sell now is the signed policy that sits above it. A tailored plan with recovery times is a later product.
| Policy pack | Done-for-you policy | |
|---|---|---|
| Price | £0 | US$99 |
| Effort from you | A few hours on the policy | A short intake form |
| What you get | Empty policy + how-to | Branded signed-ready policy |
| Playbook / BIA / RTO | Not included yet | Not included yet |
| Tender / review ready | Format the policy yourself | Policy as a clean PDF |
| If it needs changes | You redo it | We revise it free |
Prefer the business continuity policy done for you?
We can fill a branded, signed business continuity policy for US$99. A playbook with recovery times is a later product. Start here if a buyer asked for the policy first.
Requests for the business continuity plan are reviewed and prepared manually, we'll follow up by email.
Get a branded Business Continuity Policy
We fill a signed 1 to 2 page policy for US$99. Usually delivered within the hour. A playbook is a later product.
Business Continuity Policy
A branded business continuity policy, signed and ready to upload. (US$99)
Get started