Business Continuity Plan Template (Aligned to ISO 22301)

A business continuity plan is a written, tested procedure for keeping your most important activities going, or getting them back quickly, when something disrupts them: a cyber attack, a supplier failure, a power cut or the loss of a building. The free business continuity plan template below has ten copy-ready sections and a business impact analysis worksheet, and it is aligned to ISO 22301:2019, the international standard for business continuity management. Copy it from this page or download the business continuity plan template as an editable Word document with the worksheet, contact tables and an exercise log ready to fill in.

Use it as a starting point. A template only becomes a plan once your own impact analysis, contacts and recovery steps replace the bracketed text, and once you have tested it.

What should a business continuity plan include?

At minimum, a plan says what matters most, how fast it must come back, who decides and how you recover. The ten sections below cover that:

1. Purpose, scope and activation
2. Roles and contacts
3. Critical activities and recovery objectives
4. Invocation and escalation
5. Communications
6. Recovery procedures
7. Resources and alternative arrangements
8. Return to normal operations
9. Testing and exercising
10. Review and document control

Keep the core plan short enough to use under pressure. Detailed IT recovery runbooks, supplier contracts and floor plans belong in appendices.

How do you complete a business impact analysis?

Start here, before you write any plan section: the business impact analysis (BIA) decides what the plan protects and how fast. For each activity, work out how the impact of stopping it grows over time, then set four measures:

• Maximum tolerable period of disruption (MTPD): the point at which the impact of not resuming becomes unacceptable.
• Recovery time objective (RTO): the target time to resume the activity, which must be shorter than the MTPD.
• Recovery point objective (RPO): the most data you can afford to lose, which sets your backup frequency.
• Minimum business continuity objective (MBCO): the reduced level of service you can accept while recovering.

Copy this worksheet and add one row per activity. The business continuity plan example in the first row shows the level of detail to aim for; its timings are illustrative, not recommendations.

The business continuity plan template (BCP template)

This is the BCP template itself. Copy the sections below into your own document, or use the Word version, replace everything in square brackets, and attach the completed BIA worksheet.

1. Purpose, scope and activation

This plan sets out how [Organisation] continues or restores its critical activities after a disruption affecting [sites, services, systems and teams in scope]. It applies to [staff, contractors and named suppliers]. Plan owner: [role]. Approved by: [director]. Last tested: [date]. Next review: [date, no more than 12 months away].

2. Roles and contacts

Add external contacts: IT or managed service provider, cloud providers, landlord, insurer, bank, key suppliers and utilities.

3. Critical activities and recovery objectives

List each critical activity from the BIA in priority order with its owner, RTO, RPO and minimum service level. Recover activities in this order unless the continuity lead decides otherwise.

4. Invocation and escalation

Invoke the plan when [criteria, for example: a critical activity is likely to exceed half its RTO, a site is unusable, or a cyber incident affects core systems]. [Named roles] can invoke it. The continuity lead records the time, the reason and every major decision in the decision log.

5. Communications

Agree how the team will talk if email, phones or chat are unavailable or compromised, for example a personal-number call tree or a separate messaging account. Prepare holding statements for staff, customers and suppliers. Only [role] speaks to the media.

6. Recovery procedures

For each critical activity, write the steps for the first hour, the first 24 hours and until normal service returns, with who does each step and what they need.

7. Resources and alternative arrangements

Record alternative premises or remote working arrangements, spare equipment, how to restore from backups, alternative suppliers and any manual workarounds. Check that backups are kept separate from the systems they protect and that restores have been tested.

8. Return to normal operations

Set the criteria for standing down, the checks before systems return to full use, and how backlogs and manual records are brought back into normal systems.

9. Testing and exercising

Test this plan at least once a year and after significant changes. Record each exercise, its findings and the actions taken.

10. Review and document control

Review the plan after every exercise, real invocation and significant change, and at least every [12 months]. Keep a version history and make sure everyone with a role can reach the current copy, including offline.

Which cyber scenarios should the plan cover?

Cyber incidents disrupt a business differently from a fire or a flood: the building is fine, but systems, data or communications are not. Test your recovery steps against each of these:

Responding to the attack itself belongs in your incident response plan template; the continuity plan keeps the business trading while that happens. For prevention, see how to prevent ransomware.

How do you adapt the template for a small business?

Keep it short. A business with one site and a handful of staff can usually cover everything on a few pages:

• Combine roles. One person can be continuity lead and communications lead, as long as each role has a named deputy.
• List three to five critical activities, such as taking orders, paying staff and serving existing customers, and fill in the BIA worksheet for those only.
• Write down the workarounds you would really use: working from home, taking orders by phone, a spare laptop, a second internet connection.
• Keep supplier details in the plan, especially your IT support company, the cloud services you rely on and your insurer.
• Keep a copy off your systems, printed or on a personal phone, in case email and file storage are unavailable.

If customers or public sector buyers ask how you protect against cyber attacks as well, Cyber Essentials is the usual starting point for a small business.

How often should a business continuity plan be tested?

At least once a year, and after significant changes to sites, systems, suppliers or people. ISO 22301 requires an exercise programme run at planned intervals and when there are significant changes, and expects you to act on the results.

The NCSC’s free Exercise in a Box includes scenarios that small organisations can run themselves.

How does this template map to ISO 22301 and ISO 27001?

Each section supports a clause of ISO 22301:2019 and the continuity controls in ISO/IEC 27001:2022 Annex A.

A plan on its own is not enough for ISO 22301 certification, which assesses a whole business continuity management system, including the risk assessment, internal audit and management review behind the plan. Firms within the scope of the PRA and FCA operational resilience rules, such as banks, insurers and payment institutions, also set impact tolerances for important business services, and their continuity plans should support them.

Why Sovereign Secure

• ISO 27001 certified: our own information security management system is independently audited.
• ISO consultancy across 12 standards, including ISO 22301 and ISO 27001. Certification audits are carried out by our partner certification body, MQA International, which makes its own certification decisions.
• Testing that supports recovery planning: penetration testing and red team assessments show how an attacker could reach the systems your plan depends on.
• UK company since 2012, headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka.

Need help turning the template into a working plan?

Tell us your sites, critical services and whether you are aiming for ISO 22301 or ISO 27001, and we will explain how our consultancy can help and give you a fixed quote. Contact us or call +44 161 523 5276.