Business Continuity Plan Template: 5 Phases and Example

10 min read ยท 2026-11-15

A business continuity plan template gives you a fixed structure for keeping critical work running during a disruption. It covers scope, business impact analysis, recovery targets, roles, communication, recovery procedures and a test schedule. You can build it in five phases over about 13 weeks. You start with the functions that cannot stop, and you finish with a tested plan that leadership has signed off.

This guide gives you each phase with its duration and milestone. It also gives you two sheets you can copy and fill in, plus a worked example for a 50-person company, so you can see what a finished section looks like before you write your own.

The roadmap at a glance

Goal: Build, test and get leadership approval for a business continuity plan that keeps critical functions running during a disruption. Duration: 13 weeks

  1. Scope and continuity team (Weeks 1-2)

    Set the limits of the plan and name the people who will build it.

    • Get a sponsor in leadership and agree on which sites, teams and services the plan covers.
    • Name a plan owner and a deputy who can act when the owner is away.
    • Pick one person from each department: operations, IT, finance, HR, customer support and sales.
    • List the disruptions in scope: loss of the building, IT outage, loss of key staff, supplier failure and cyber incident.

    Milestone: The sponsor approves the scope document and the team list.

  2. Business impact analysis (Weeks 3-5)

    Find out which functions matter most and how long each one can stop.

    • Interview each department lead with the same short questionnaire.
    • For each function, write down what it depends on: people, systems, data, suppliers and premises.
    • Describe the impact of a stop after 4 hours, 1 day and 1 week: lost revenue, customer harm, legal duties and reputation.
    • Rank the functions into priority tiers. Give each one a recovery time objective (RTO) and a recovery point objective (RPO).

    Milestone: Each department lead signs off a BIA summary that ranks every critical function.

  3. Recovery strategies and resources (Weeks 6-8)

    Decide how each critical function keeps going or comes back.

    • Choose a workaround for every tier 1 function: remote work, a second site, a manual process or a backup supplier.
    • Check that your backups and system restores can actually meet the RTO and RPO you set in phase 2.
    • Find any skill that only one person has, and train a second person in it.
    • List the equipment, accounts and spending approvals you need in the first 48 hours.

    Milestone: Every tier 1 and tier 2 function has a recovery strategy and confirmed resources.

  4. Write the plan and communication (Weeks 9-11)

    Turn decisions into procedures people can follow under stress.

    • Write a step-by-step recovery procedure for each critical function, with a named owner on every step.
    • Map the decision chain: who declares an incident, who approves spending, who speaks to the outside, and the deputy for each role.
    • Draft message templates for staff, customers, leadership and suppliers.
    • Build the contact list and keep copies offline, outside your main systems.

    Milestone: The continuity team has reviewed a complete draft of the plan.

  5. Train, test and approve (Weeks 12-13)

    Prove the plan works before you have to rely on it.

    • Brief everyone who has a role in the plan.
    • Run a tabletop exercise on one realistic scenario, such as the main office being closed for a week.
    • Log every gap the exercise exposes and fix it in the plan.
    • Present the final plan to leadership and set the review calendar.

    Milestone: Leadership approves the plan and the first live test date is in the calendar.

What a business continuity plan template should include

A usable template has the same sections whatever the size of the company. The difference between a short plan and a long one is the number of functions covered, not the structure. If a section is missing, people will improvise it during the incident.

Keep the plan easy to scan. During an incident, nobody reads long paragraphs.

  • Purpose, scope and the date of the last review
  • Plan owner, continuity team and the decision chain with deputies
  • Business impact analysis: critical functions, dependencies and priority tiers
  • Recovery targets for each function (RTO and RPO)
  • Recovery strategies and workarounds
  • Step-by-step recovery procedures with owners
  • Communication plan and message templates
  • Contact list for staff, suppliers, insurers and key customers
  • Supplier dependencies and fallback options
  • Testing, training and maintenance schedule

Fill-in function sheet (one per critical function)

These two sheets are the core of the template. Copy them into your document, then make one function sheet per critical function and one procedure sheet per recovery procedure.

Fill this sheet in during phase 2, then complete the last two lines in phase 3.

  • Function:
  • Function owner:
  • Deputy:
  • Priority tier (1, 2 or 3):
  • Depends on people:
  • Depends on systems and data:
  • Depends on suppliers:
  • Depends on premises:
  • Impact if stopped for 4 hours:
  • Impact if stopped for 1 day:
  • Impact if stopped for 1 week:
  • RTO (how fast it must be back):
  • RPO (how much data you can afford to lose):
  • Fallback solution:
  • Resources needed in the first 48 hours:

Fill-in procedure sheet (one page per procedure)

Fill this sheet in during phase 4. If it does not fit on one page, split it into two procedures.

  • Procedure name:
  • Linked function and tier:
  • Trigger (what event starts this procedure):
  • Who declares it:
  • Step 1: action, owner, contact
  • Step 2: action, owner, contact
  • Step 3: action, owner, contact
  • Add steps as needed, each with its owner and contact.
  • Done when (the condition that ends the procedure):
  • Who to inform when it is done:
  • Last tested on:

Business continuity plan steps: the 5-step and 8-step versions

A short version has five steps. You run a business impact analysis, form a continuity team, write the plan, secure the resources it needs, then train people and test it. The roadmap above follows that order, with the team formed first so the analysis has owners.

Both versions cover the same ground. Use the 5-step version to explain the project to leadership. Use the 8-step version as a checklist so nothing gets skipped, especially the review and revision at the end.

The Business Development Bank of Canada (BDC), in its guide "Business continuity plan (BCP) in 8 steps, with templates", breaks the same work into eight steps:

  • Establish an emergency preparedness team.
  • Identify essential services and functions.
  • Identify required skill sets and staff reallocation.
  • Identify potential issues.
  • Prepare a plan for each essential service or function.
  • Compare with a preparedness checklist.
  • Review with the emergency preparedness team.
  • Revise, test and update the plan.

Business continuity plan example: critical functions and recovery targets

The example below is for a fictional B2B services company. It has 50 people, one office, cloud software and a customer support team. All recovery targets are examples to show the format. Set your own from your impact analysis.

  • Tier 1, customer support: RTO 4 hours, RPO 1 hour. Fallback: agents work from home and reach the support inbox from any browser.
  • Tier 1, client delivery systems: RTO 8 hours, RPO 4 hours. Fallback: restore from the latest backup and move clients to a read-only status page.
  • Tier 2, invoicing and payments: RTO 2 days, RPO 1 day. Fallback: finance issues manual invoices from a template stored offline.
  • Tier 2, sales pipeline: RTO 2 days, RPO 1 day. Fallback: account executives work from an exported list of open deals.
  • Tier 3, recruiting, internal reporting and marketing campaigns: RTO 1 week. Fallback: paused until tier 1 and tier 2 are back.

Example: roles and decision chain

Every role in the example company has a named deputy, so the plan still works when one person is away or affected by the incident.

  • Incident lead: Head of Operations. Deputy: Office Manager. Declares the incident and runs the response calls.
  • IT recovery lead: IT Manager. Deputy: the account contact at the external IT provider. Restores systems in tier order.
  • Communications lead: Marketing Lead. Deputy: Customer Success Lead. Sends every message to staff, customers and suppliers.
  • Finance lead: Finance Manager. Deputy: CEO. Approves emergency spending.
  • Final decision maker: CEO. Deputy: COO. Decides when the incident is over.

Example: communication script

First message to staff, within one hour: "We have an incident affecting the office systems. Customer support moves to remote work now. Your manager will call you within two hours with next steps. Do not post about this on social media."

First message to customers, after the incident lead approves it: "We are dealing with a service disruption. Support remains open by email. We will send our next update by 4 pm today."

Leadership gets an update at fixed times agreed when the incident is declared, even when nothing has changed.

Example: suppliers and fallbacks

Each supplier the example company depends on has a fallback agreed before any incident happens.

  • Cloud hosting: confirm the provider's restore process and keep an emergency support contact in the offline list.
  • Internet access: a mobile hotspot for each tier 1 employee.
  • Payroll provider: keep a copy of last month's payroll file in case the system is down on pay day.
  • Office: agree in advance on a coworking space or full remote work.

Business continuity plan vs disaster recovery plan vs crisis management

A business continuity plan keeps the whole business running during and after a disruption: people, processes, premises and suppliers. A disaster recovery plan is narrower. It restores IT systems and data, and it usually sits inside the continuity plan as one of its procedures. Crisis management covers the leadership response: decisions, public statements and protecting the company's reputation while the event unfolds.

You need all three, but they should not be three separate projects. Write the continuity plan first. Link the disaster recovery steps to the tier 1 functions they support, and let the crisis management role sit in the decision chain at the top of the plan.

How to present the plan to leadership

Leadership will not read every procedure. They want to know what is protected, how fast it comes back, what it costs and who is in charge. Open with a one-page summary and keep the procedures as an appendix.

A visual roadmap of the five phases helps leadership see where the project stands at a glance. Show each milestone as done or pending, so the approval step at the end feels like the natural close of a plan they have followed.

Put these points on the summary page:

  • The functions in tier 1 and their recovery targets
  • The three biggest risks found in the impact analysis
  • The decisions or budget you need from leadership
  • The decision chain, with names and deputies
  • The test calendar for the next 12 months

How often to test and update the plan

Asana's "Business Continuity Plan Template for Emergency Planning" says to test the plan at least once or twice a year, and to review it quarterly or twice a year, and also whenever your team, vendors or technology change in a big way. Start with a tabletop exercise, where the team talks through a scenario step by step. Move to a live test, such as a day of full remote work for support, once the procedures are stable.

Some events should trigger an update outside the calendar:

  • A new core system or a change of IT provider
  • A move to a new office or the opening of a second site
  • A person in the decision chain leaving the company
  • Any real incident, followed by a written review of what worked and what did not

Common mistakes to avoid

  • Writing the plan before the impact analysis. Run the analysis first and let it decide which functions get procedures.
  • Naming roles without deputies. Give every role a backup who has read the plan.
  • Storing the plan only on systems that might go down. Keep a printed copy and an offline copy with the contact list.
  • Setting the same recovery target for every function. Rank functions into tiers and protect tier 1 first.
  • Treating approval as the finish line. Book the first test date in the meeting where leadership signs off.
  • Copying a large company template word for word. Keep the structure and cut every section that does not match your size.

Frequently asked questions

What are the four P's of business continuity planning?

CMAC Group's guide "A step-by-step guide to writing an effective Business Continuity Plan" lists them as people, processes, premises and providers. People covers staff, customers and clients. Processes covers the technology and methods that keep work running. Premises covers your buildings, and providers covers the suppliers and partners you rely on. Use them as a check on every function sheet.

Who should be involved in building a business continuity plan?

You need a leadership sponsor, a plan owner, and one person from each department that runs a critical function. IT, finance, HR and customer-facing teams should always be part of it. External providers can review the sections that depend on them.

How long should a business continuity plan be?

Keep it as short as you can while still covering every critical function. Put a one-page summary at the front, keep each recovery procedure to one page, and move contact lists to an appendix. If nobody can scan it during an incident, it is too long.

Can a small business use an enterprise template?

Yes, if you cut it down. Keep the structure: impact analysis, recovery targets, roles, communication, procedures and testing. Remove the sections built for multiple sites or regulated industries that do not apply to you.

Generate this roadmap with AI