Business Continuity Plan Template

A practical business continuity plan (BCP) kit for small and mid-sized organisations. It gives you a structured Word plan to complete, Excel worksheets for the business impact analysis and risk assessment, and the checklists and logs you need to keep the plan alive.

What a business continuity plan is for

A business continuity plan sets out how your organisation keeps its most important services running — or restores them quickly — after a disruption such as a fire, flood, power cut, cyber attack, supplier failure, pandemic or the sudden loss of key staff. It is different from an emergency evacuation plan, which protects people in the first minutes, and from an IT disaster recovery plan, which restores systems. A good BCP ties these together and answers one question: what do we do, in what order, to keep serving customers?

Many larger customers, insurers, lenders and public-sector buyers now ask suppliers whether they have a continuity plan. The kit is written for organisations without a dedicated risk department, and follows the widely used cycle of analysing impact, choosing strategies, documenting the plan, and testing it.

What is included

• Business continuity plan (Word) — a complete plan with numbered sections: purpose and scope, roles, activation criteria, critical activities, recovery strategies, communication, return to normal and maintenance.
• Business impact analysis worksheet (Excel) — list activities, rate impact over time, and set the maximum tolerable period of disruption (MTPD), recovery time objective (RTO) and recovery point objective (RPO).
• Risk assessment matrix (Excel) — likelihood × impact scoring with automatic risk ratings and a treatment column.
• Emergency contact and call tree list — staff, key customers, suppliers, utilities, insurers and landlord.
• IT disaster recovery checklist — backups, restores, access and critical software.
• Crisis communication plan — who speaks, holding statements and message templates for staff, customers and suppliers.
• Remote working continuity plan — what staff need to work from home at short notice.
• Supplier continuity checklist — questions to ask critical suppliers.
• Plan test and exercise log — record tabletop exercises, findings and actions.

How to complete the plan in five steps

1. Scope it. Decide which sites, teams and services the plan covers, and name a plan owner.
2. Run the business impact analysis. For each activity, estimate how the impact grows after 4 hours, 1 day, 3 days and 1 week. The point at which it becomes unacceptable is the MTPD; set the RTO shorter than that.
3. Assess risks. Score threats by likelihood and impact to decide what to reduce now (for example, off-site backups) and what to plan around.
4. Choose recovery strategies. For each critical activity, record the workaround: alternative site, remote work, manual process, backup supplier, or cross-trained staff.
5. Test and maintain. Walk through a scenario with the team at least once a year, record the gaps in the test log and update the plan and contact lists.

Key terms used in the templates

Who the kit suits

Owners and managers of small businesses, practice managers in clinics or professional firms, operations leads in nonprofits and schools, and anyone asked by a customer or insurer to “send us your business continuity plan”. Example text is written for a generic small office and a small shop or service business; replace the bracketed prompts with your own details. The structure is compatible with common guidance such as ISO 22301 concepts, but the kit is not a certification package and does not guarantee compliance with any standard or regulation.

Formats

The plan, communication plan and checklists come as editable DOCX files and print-ready PDFs. The business impact analysis and risk matrix are XLSX workbooks with scoring formulas and conditional colouring, and are also provided as PDFs for printing. No macros are used. Files open in Microsoft Office, LibreOffice and Google Workspace (formatting may shift slightly outside Office).

Tips for a plan people will actually use

• Keep the first page to one screen: who can activate the plan, how to reach them, and the first five actions.
• Store copies where you can reach them during an outage — printed, and on a phone — not only on the office server.
• Name deputies for every role; disruptions often coincide with holidays.
• Update contact details every quarter and after staff changes.
• Test with a realistic scenario, such as “the office is inaccessible for three days from Monday morning”.