Sample business continuity plan template for small businesses

Why you need a business continuity plan

A business continuity plan not only guarantees the business can continue to operate, serve customers and earn revenue during an interruption, but it also increases the odds the business will successfully ride out the disaster and survive. Organizations need to have a BC plan in place in anticipation of a variety of threats, including the following:

• natural disasters
• terrorist attacks
• infrastructure failures
• staff disruption
• work stoppages
• data corruption
• theft
• breaks in the supply chain

Besides being a good business practice, companies may need business continuity plans for insurance or compliance reasons.

A continuity plan, as exemplified by our sample business continuity plan template, can also improve internal and external communication, reduce downtime, and prepare employees and executives for disaster. It helps everyone gain a better understanding of the business and its operations, and it identifies ways to fortify any deficiencies -- both large and small.

A business resumption plan is similar to a business continuity plan, except it does not focus on implementing continuity procedures to keep a business up and running during an interruption or disaster. Rather, a business resumption plan addresses two main points: preventive measures and, as the name indicates, resuming operations.

Small-business BCP

For small businesses, the business continuity planning (BCP) process contains several steps, including the following:

• project initiation;
• risk assessment;
• business impact assessment;
• strategy development;
• business continuity plan development; 
• business continuity plan testing and maintenance;
• emergency communications;
• awareness and training; and
• coordination with public authorities.

This is comparable to the business continuity process found in larger organizations. The only difference is the BCP process for small businesses can be simplified depending on the size and complexity of the organization.

For many small businesses, the above business continuity planning activities pose a formidable challenge, especially from the perspectives of time, money and resources. To make the process easier, small businesses have several options, such as BCP tools and software, business continuity templates, checklists or consultants. Each of these options can create a plan and its associated elements. And, because of their simplicity, small businesses often use them to get something done quickly.

What you need for a successful business continuity plan

To develop a successful BC plan, we recommend the following steps:

• Make sure you have the right information. Your business continuity plan doesn't have to be hundreds of pages long; it just needs the right information, and that information should be current and accurate. A one-page plan with the right information can be more valuable than a voluminous document nobody can use.
• Go to ready.gov-- part of the Federal Emergency Management Agency site -- and look at the available emergency plan development information. The information at ready.gov can serve as an effective complement to the sample business continuity plan template we provide in this report.
• Standards can provide a useful starting point. Almost two dozen business continuity standards are available worldwide. In the U.S., several options are currently in use: NFPA 1600, the current U.S. national standard; BSI BS 25999, the British standard; and the FFIEC Business Continuity Handbook, which is used by the banking and finance sectors.
• Limit content to actual disaster response actions.
• Make it happen. Once the plan is complete, exercise it semiannually to ensure the documented procedures make sense in the sequence indicated.
• Be flexible. A single template may not be universally applicable to all departments or locations in your organization.

How the sample business continuity template is organized

Next, we'll examine the structure and content of our sample business continuity plan template, indicating key issues to address and activities to perform.

1. Initial data. If you have identified various people to contact in an incident, put their contact information at the front of the plan -- in the emergency notification contacts section -- so you won't have to waste valuable seconds searching through a lengthy document.
2. Revision control page. This is page two of the plan, and it reflects your change management process.
3. Purpose and scope. Provide details on these attributes, as well as assumptions, team descriptions, a list of terms and other background information.
4. Instructions for using the plan. Provide information about when and how the plan will be activated, including outage time frames, who declares a disaster and who should be contacted.
5. Policy information. This is a good place to use standards documents as references.
6. Emergency response and management. Specify situations in which the plan and response procedures are to be activated.
7. Plan reviews and maintenance. Describe how often the plan is to be reviewed and updated and by whom.
8. Checklists and flow diagrams. Assuming an incident has occurred, identify the steps to address it. These can be in the form of checklists -- useful to keep track of scheduled and completed tasks -- and flow diagrams that provide a high-level view of response and recovery.
9. Notification of an incident affecting the site. Information needs to be gathered before officially declaring a disaster. This includes damage assessment data and firsthand reports from staff and first responders. Convene meetings as soon as possible with key emergency team members to evaluate the facts before proceeding to a declaration.
10. Decide on a course of action. This section addresses actions to take when it becomes obvious that management needs to declare a disaster. A damage assessment can be initiated before or after the declaration -- it is up to company leadership.
11. Business recovery phase. This section provides instructions on recovering operations, relocating to an alternate site and related activities.
12. Appendices. Detailed appendices are provided at the end of the template. These include lists and contact details for all emergency teams, primary and alternate vendors, alternate workspace locations and other relevant information. It is very important to keep this information up to date.

How to maintain a business continuity plan

Regrettably, after a BC plan has been developed, many businesses view that as the end of the process; few businesses invest in exercises to ensure their plans work and stay up to date. To get the most out of your business continuity plan, you should integrate its upkeep into your daily operations and activities. Think of it as a living document that requires regular reviewing and updating.

A business continuity plan need not be reviewed all at once. Create and follow a schedule to make the process more manageable and less daunting. Start by focusing on sections that are most likely to change over the next year.

These most likely include your organization's emergency team names and contact details, as well as lists of mission-critical equipment and applications, vendors and suppliers, vital records and critical business documents, manufacturing components, organizational charts, minimal operational requirements to resume business, emergency supplies, and employee and contact details.

Implementing a business continuity management system

Another strategy to ensure your business continuity plan remains up to date is to implement a business continuity management system (BCMS) that identifies routinely executed day-to-day activities that are essential for business continuity. Many actions fall under the purview of a BCMS, including budgeting, project planning and management, communications, resource management, performance assessment activities, scheduling, and forecasting.

You can also use a BCMS to initiate and support a variety of project-based activities related to the upkeep and maintenance of your BC plan. These include running assessments, running business impact and risk analyses, developing and documenting the business continuity plan itself, preparing and implementing business continuity exercises, planning and carrying out emergency team training, formulating and keeping a record of incident response tactics, and defining your business continuity strategies.

A number of standards have emerged that lay out the requirements for management systems that guard against, lower the prospect of and ensure your business recovers from disruptive events. Chief among these is ISO 22301:2012, which is frequently complemented by a number of other ISO 223XX standards and guidelines for business impact analysis, supply chain continuity, incident preparedness and more.

There are also country-specific business continuity standards from the likes of the International Organization for Standardization, the National Fire Protection Association and the Financial Industry Regulatory Authority.