What Is a Business Continuity Plan? How to Write One (With Template)

A business continuity plan (BCP) is a documented plan that sets out how an organisation will keep its most important activities running during a disruption, and how it will recover afterwards. The disruption might be a fire or flood, a cyber attack, a power cut, a supplier failure, severe weather or anything else that stops people working as normal.

Most business continuity plans focus on systems, premises and suppliers. The best ones also answer a simpler question: when something goes wrong, how do we reach our people, make sure they are safe and tell them what to do next? This guide covers both.

Book a call with our team

Why a business continuity plan matters

Disruption is rarely as rare as it feels. Storms, IT outages, building closures and supply problems happen every year, and most organisations will face at least one serious incident at some point. A business continuity plan helps you:

• Protect people: the first priority in any incident is the safety of staff, visitors and customers.

• Keep critical services running: so customers, patients or the public are not left without help.

• Reduce losses: every hour of downtime can cost revenue, contracts and reputation.

• Meet obligations: contracts, regulators, insurers and customers increasingly expect to see a plan.

• Make decisions faster: when roles and steps are agreed in advance, people act rather than debate.

In the UK, the Civil Contingencies Act 2004 requires emergency responders to have business continuity arrangements in place, and local authorities promote business continuity to local organisations. For most private businesses a BCP is not a legal requirement, but it is widely seen as good practice and is often a condition of contracts and insurance.

Business continuity plan vs disaster recovery plan

The two terms are often used together, but they are not the same.

• Business continuity covers the whole organisation: people, premises, processes, suppliers, communication and technology. It asks how you keep delivering what matters during disruption.

• Disaster recovery is usually a part of business continuity focused on IT: restoring systems, data and networks after an outage.

A disaster recovery plan without a wider continuity plan can bring your servers back online while nobody knows where to work or who is in charge.

What should a business continuity plan include?

Every plan will look different, but most good plans include the same core sections.

Scope and objectives

What the plan covers, which sites and teams are included, and what it is trying to achieve.

Roles and responsibilities

Who leads the response, who deputises, and who is responsible for communication, IT, facilities, HR and suppliers. Include contact details and backups for every role.

Critical activities

The products, services and processes that must keep running, and how quickly each needs to be restored. These are usually set out in a business impact analysis.

Risks and scenarios

The incidents most likely to affect you, such as loss of a building, loss of IT, loss of key staff, supplier failure or severe weather.

Response and recovery steps

What to do in the first hour, the first day and the first week of an incident, and how you will return to normal.

Communication plan

How you will contact staff, customers, suppliers and stakeholders, which channels you will use and who approves messages. This is often the weakest part of a plan, so it is worth getting right.

Resources and workarounds

Alternative premises, remote working, backup equipment, manual processes and alternative suppliers.

Testing and review

How often the plan is tested and updated, and who owns it.

How to write a business continuity plan in 7 steps

1. Get senior support and build a team

Business continuity needs a sponsor at board or leadership level who can make decisions and release resources. Bring in people from operations, IT, facilities, HR, finance and communications, so the plan reflects how the organisation really works.

2. Carry out a business impact analysis

List your activities and ask what would happen if each one stopped for an hour, a day or a week. This tells you what is critical and sets three key measures for each activity:

• Maximum tolerable period of disruption: the point at which the impact of an outage becomes unacceptable.

• Recovery time objective (RTO): the target time to get the activity running again, set well inside that limit.

• Recovery point objective (RPO): how much data you can afford to lose, measured as time since the last backup.

3. Assess your risks

Identify the threats most likely to disrupt your critical activities and how likely and serious each one is. Record them in a risk register with an owner for each risk, and decide whether to reduce, transfer (for example through insurance), avoid or accept it.

4. Decide your continuity strategies

For each critical activity, decide how you will keep it going. That might mean working from another site, switching to manual processes, using a second supplier or moving work to another team.

5. Write the plan

Keep it short, clear and easy to follow under pressure. Use checklists, contact lists and simple decision points rather than long paragraphs.

6. Plan how you will communicate

Decide how you will reach every member of staff quickly, including people working remotely, on the road or out of hours. Many plans still rely on a phone call tree, where each person calls the next, but call trees break as soon as one person does not answer. Email alone is often too slow in an emergency, as our post on why email alone isn't enough explains.

7. Test, train and review

Run tabletop exercises and live tests at least once a year, and after any major change. Review the plan after every real incident and update it with what you learned.

Business continuity plan template

Copy this outline into your own document and tailor each section to your sites, teams and risks.

Section	What to include
1. Plan overview	Purpose, scope, sites covered, plan owner, date of last review
2. Incident team	Names, roles, deputies and contact details for the response team
3. Activation	Who can activate the plan, the triggers for doing so and how the team is called together
4. Critical activities	Each critical activity, its recovery time objective and the people and resources it needs
5. Response steps	Actions for the first hour, first 24 hours and first week
6. Communication	How staff, customers, suppliers and the media will be contacted, and who approves messages
7. Staff safety and welfare	How you will account for staff, support anyone affected and manage remote or lone workers
8. Workarounds	Alternative locations, remote working, manual processes and backup suppliers
9. Recovery	How you will return to normal and decide when the incident is over
10. Testing and review	Test schedule, training, and the process for updating the plan

Business continuity plan examples

These short scenarios show how a plan turns into action.

Example 1: an office is flooded overnight

The facilities lead activates the plan at 6am. Staff are told by text and app not to travel in and to work from home. Customer-facing teams move to laptops and cloud phone systems, and the incident team confirms by mid-morning that everyone has seen the message.

Example 2: a cyber attack takes systems offline

IT isolates affected systems and switches to backups in line with each system's RPO. Because email may be compromised, the incident team uses a separate channel to brief staff and tells them which manual processes to use until systems are restored.

Example 3: severe weather closes roads

Ahead of a red weather warning, the plan's weather trigger is used. Staff in the affected area are told to stay at home, site managers confirm who is still on site, and lone workers in the area are asked to check in at agreed times.

Example 4: a key supplier fails

The plan names a second supplier for critical stock. Purchasing switches orders, customers are told about any delays, and the business impact analysis is updated to reflect the new dependency.

Business continuity planning for small businesses

Small businesses often have the most to lose from disruption and the least spare capacity. A small business plan can be a few pages long, but it should still cover who is in charge, the handful of activities that keep money coming in, how you will contact staff and customers, where you will work if the premises are unavailable, and where copies of key documents and contact lists are kept, including a paper copy.

Common business continuity planning mistakes

• Writing the plan and never testing it: untested plans fail on the day.

• Focusing only on IT: systems come back, but people do not know where to go or what to do.

• Out-of-date contact details: the plan is only as good as the numbers in it.

• Relying on one communication channel: if email or the phone system is down, so is your plan.

• Forgetting remote, lone and travelling staff: they are often the hardest people to reach and account for.

• No clear owner: without someone responsible for keeping it current, the plan goes stale.

Business continuity standards and guidance

• ISO 22301: the international standard for business continuity management systems. Organisations can certify against it.

• The Business Continuity Institute (BCI): publishes good practice guidelines and training.

• GOV.UK and local resilience forums: publish free toolkits and templates for small businesses and voluntary organisations.

How Vismo supports business continuity

Vismo helps you protect and communicate with your people when disruption hits, which is the part of a business continuity plan that most often fails under pressure.

• Mass notification: send alerts to staff by SMS, voice, email, app, Microsoft Teams and Slack at the same time, so messages get through even if one channel is down.

• Know who is safe: staff reply with a single tap, and your incident team sees in real time who has not yet responded.

• Location-based targeting: geofencing lets you alert only the people at an affected site or in an affected area.

• Early warning: threat intelligence feeds flag events near your sites and people.

• Response procedures: Vismo Workflows turns your continuity procedures into guided steps, so whoever is on duty follows the same process and every action is timestamped for your post-incident review.

• Evidence for your review: every message, reply and action is logged for your post-incident report and auditors.

See how Vismo's critical event management solution brings these together in one platform.

Business continuity plan FAQ

What does BCP stand for?

In a business context, BCP stands for business continuity plan, or business continuity planning when it refers to the process of creating and maintaining the plan.

What are the key components of a business continuity plan?

A business impact analysis, a risk assessment, continuity and recovery strategies, a communication plan, clear roles and responsibilities, and a programme of testing and review.

What is the difference between BCP and BCM?

A business continuity plan (BCP) is the document that sets out what to do in a disruption. Business continuity management (BCM) is the wider, ongoing programme that keeps the plan current, including governance, training, exercises and review. ISO 22301 sets out requirements for a business continuity management system.

What is the main purpose of a business continuity plan?

To keep an organisation's most important activities running during a disruption and to recover quickly afterwards, while keeping people safe.

Is a business continuity plan a legal requirement in the UK?

For emergency responders covered by the Civil Contingencies Act 2004, yes. For most private businesses it is not a legal requirement, but customers, regulators and insurers often expect one.

How often should a business continuity plan be tested?

At least once a year, and after any significant change to the organisation, its sites or its systems. Many organisations also run short exercises every quarter.

What is a business impact analysis?

A business impact analysis identifies your critical activities and the impact of losing them over time. It sets how quickly each activity needs to be restored.

What is the difference between business continuity and crisis management?

Crisis management is about leading the response to a serious event, including decisions and communication. Business continuity is about keeping critical activities running and recovering them. The two work together.

Be ready before disruption hits

A business continuity plan only works if you can reach your people when it matters. Vismo helps you warn staff, confirm they are safe and coordinate your response from one place.

Request a product demo