A business continuity plan (BCP) is broader than IT disaster recovery: it covers how your entire business keeps functioning through any major disruption, from a cyberattack to a fire, flood, or extended power outage. Use the sections below as a starting framework for your own plan.

1. Critical Business Functions

• List the functions that must continue even in a crisis (payroll, client service, order fulfilment)
• Identify the minimum staff and systems needed to keep each function running
• Note any function that depends entirely on a single person, tool, or location

2. Risk Scenarios

• Ransomware or major cyberattack
• Extended internet or power outage
• Loss of physical office access (fire, flood, damage)
• Loss of a key vendor, supplier, or cloud service provider

3. Response Plan

• Who is responsible for declaring an incident and leading the response?
• What is the communication plan for staff, clients, and vendors during a disruption?
• Where can staff work from if the primary office is unavailable?
• What is the order in which systems should be restored?

4. Testing & Maintenance

• Schedule at least one tabletop exercise per year to walk through the plan
• Review and update contact lists, vendor details, and system inventories regularly
• Document lessons learned after any real incident or test, and update the plan accordingly