Business Continuity Plan template

2. Policy statement

{{org.name}} is committed to protecting the safety of its people first, then its ability to serve customers and meet its obligations to staff, suppliers, and regulators. We will plan for disruption honestly, keep the plan current, and test it rather than assume it works.

3. Roles and responsibilities

• Continuity lead ([name/role]): invokes this plan, leads the response, and is the single decision-maker during an incident. Deputy: [name/role].
• Communications owner ([name/role]): handles messages to staff, customers, and suppliers using the arrangements in this plan.
• [Name/role]: owns IT and data recovery, including backups and data breach assessment.
• All staff: know where the plan is kept, follow the communications channel below, and do not speak to press or post about incidents on social media.

4. Scenarios we plan for

• Premises unusable (fire, flood, damage, denial of access): fallback is [alternative site / remote working / mobile arrangement].
• IT failure or cyber attack: fallback is [backup and restore arrangement, manual workaround — e.g. paper order pads, backup card terminal].
• Loss of utilities (power, water, gas): fallback is [arrangement, e.g. safe shutdown steps and temporary closure criteria].
• Key people unavailable (illness, resignation, emergency): critical tasks and deputies are listed under recovery priorities.
• Key supplier failure: alternative suppliers for [critical items] are listed in the contacts annex.

5. Invoking the plan

1. 1Make people safe first: follow the emergency procedures for the incident (evacuation, first aid, 999) before anything in this plan.
2. 2The continuity lead (or deputy) decides whether to invoke the plan and records the decision and time.
3. 3Assemble the response team — in person or on [channel] — and assess what is affected, for how long, and what can still run.
4. 4If personal data may be involved, start the data breach response procedure immediately — the 72-hour ICO clock runs from awareness.
5. 5Notify the insurer ([name/policy number]) and landlord [if applicable] before authorising clean-up or repairs beyond making things safe.
6. 6Work through the recovery priorities below, log every decision and expense, and reassess at least daily.

6. Communications during disruption

Staff are contacted through [channel — e.g. WhatsApp group or phone cascade] by the communications owner; the staff contact list is kept current at [location]. Tell staff what happened, whether to come in, and when the next update will come — silence fills itself with rumour.

Customers are told the practical truth — what is closed or delayed and when to expect an update — through [website, social channels, signage, direct contact for bookings]. Only the communications owner or continuity lead speaks for the business.

7. Recovery priorities

• Within [number] hours: [e.g. make the premises safe, secure stock and cash, contact all staff, redirect deliveries].
• Within [number] days: [e.g. restore payment and till capability, resume core service even if reduced, contact key customers and suppliers].
• Within [number] weeks: [e.g. return to full trading, replace equipment, progress the insurance claim, review what happened].
• Critical dependencies and deputies: [task — payroll, ordering, banking — with who does it normally and who can cover].

8. Testing, records and review

The plan is tested at least [frequency, e.g. annually] with a walkthrough of one scenario, and contact lists are verified [frequency, e.g. quarterly]. Test findings, incident logs, and decision records are kept at [system/location].

The plan is reviewed [frequency], after every invocation or near-miss, and when premises, systems, key staff, or suppliers change. Owner: [name/role]. Next review due: [date].