Business continuity plans get written for two very different reasons. Sometimes an insurer, a tender or a big customer demands one, and a document is produced to make the question go away. And sometimes a business owner has the 2am realisation: if the building, the internet, our biggest supplier or our one irreplaceable person disappeared tomorrow, nobody here actually knows what we would do.
This template serves the second purpose while satisfying the first as a side effect. It is deliberately SME-sized: seven sections, honest questions, no corporate wallpaper. The IT-specific recovery detail lives in a companion document (our disaster recovery plan template) which this plan references as its IT annex; everything else about keeping the business alive lives here.
The template
Section 1 — Critical activities and tolerances
Before scenarios, the foundation: list the handful of activities your business cannot stop doing (taking orders, delivering the service, paying staff, answering customers), and for each, how long it could stop before damage becomes serious. Days? Hours? This list, usually five to eight items, is what the whole plan protects, and every later decision refers back to it. Include the peak-period note: tolerances that are comfortable in February may be existential in your busy season.
Section 2 — Roles and activation
Who declares an incident, who leads the response, who deputises for each, and how the plan is activated out of hours. Name people, not job titles alone, and record two contact routes for each. Add a one-line authority note: what the incident lead may spend or decide without further sign-off. Crises are slowed less by the problem than by nobody being sure they are allowed to act.
Section 3 — Scenario plans
The core of the document: half a page per scenario covering first actions, workarounds that keep Section 1’s activities running, and the recovery route. Write the five that fit your business; the common set:
- Premises unavailable (fire, flood, denied access): where each team works from, how calls divert, what physical kit or stock matters and its backup arrangement
- IT failure or cyber attack: point to the DR plan as the technical route, and cover the business half here: manual workarounds while systems return, and who pauses which promises to customers
- Key person unavailable: for each person whose absence stops something in Section 1, where their knowledge, passwords and relationships are documented, and who steps in. This is the scenario SMEs most often cannot answer, and writing it down usually triggers useful fixes on the spot
- Critical supplier failure: for each supplier whose failure stops you, the fallback: an alternative supplier already identified, a stock buffer, or a contractual protection
- Loss of utilities or connectivity: the short-outage workaround, and the duration at which this escalates into the premises scenario
Section 4 — Contact directory
Staff (with out-of-hours numbers), customers who must be told early, suppliers, landlord, insurer and broker (policy numbers here), bank, and your IT provider. Held both digitally (reachable from a phone) and printed with the incident lead and deputy: a continuity plan that depends on the systems it exists to survive has one obvious flaw.
Section 5 — Communication plan
Three audiences, one owner each: staff (via a channel independent of company systems), customers (holding statement drafted in advance, blanks for the specifics), and, where relevant, public or press (one named voice, everyone else redirects). Pre-drafting the dull paragraphs is a gift to your future stressed self.
Section 6 — Insurance and obligations
What your business-interruption and cyber policies actually cover, the notification deadlines they impose (some are surprisingly short), and any regulatory or contractual duties an incident triggers, from ICO notification where personal data is involved to client-contract SLAs. Summarise; do not transcribe. The point is that the incident lead can see the obligations without reading a policy schedule mid-crisis.
Section 7 — Testing and review
Same heartbeat as the DR plan: one tabletop walkthrough of a scenario each year (an hour around a table, someone reads the scenario, everyone answers “what do we actually do?”), review after any real incident, staff change in named roles, office move or major system change, and a dated revision table so a reader knows the plan’s vintage at a glance. The walkthroughs are where plans earn their keep: every one we have facilitated has surfaced at least one “wait, that person left” or “that number is dead”.
Making it real: three rules
Write facts, not intentions. “Backups are tested quarterly” must be true on the day it is written, or written as an action instead. A plan of aspirations fails at the exact moment of consultation, which is the expensive moment. (The same rule anchors the IT annex; the 3-2-1 backup rule is the standard your backup claims should meet.)
Keep it under ten pages. Length is where continuity plans go to die. Detail belongs in annexes and linked procedures; the plan itself is the map a stressed person follows.
Give it an owner. One named person keeps it current, with the review dates in their calendar, not in the document’s good intentions.
Frequently asked questions
What should a UK business continuity plan include?
Critical activities and how long each can stop, named roles with activation authority, scenario plans (premises, IT/cyber, key person, supplier, utilities), a contact directory held offline, communication arrangements, insurance and notification obligations, and a testing schedule.
What’s the difference between a business continuity plan and a disaster recovery plan?
The BCP keeps the whole business operating through disruption; the DR plan is its IT annex, restoring systems and data specifically. Insurers and tenders increasingly expect the pair, cross-referenced.
How long should a small business continuity plan be?
Under ten pages, with detail pushed to annexes. The corporate eighty-page version signals thoroughness to auditors and delivers nothing at 2am; SME plans are used, so they must be short.
Is a business continuity plan a legal requirement in the UK?
For most SMEs, no statute demands one, but contracts, insurers and regulated-sector rules increasingly do, and directors’ general duties point the same way. In practice the demand arrives commercially before it arrives legally.
How often should the plan be tested and reviewed?
An annual tabletop walkthrough at minimum, plus review after real incidents and significant changes to people, premises, systems or suppliers. A plan describing the business of two years ago is the most dangerous kind: it looks like preparedness.
Who should write it: us or our IT provider?
Jointly. Only you can answer the business questions (tolerances, priorities, who speaks for the company); your IT provider owns the technical annex and, done well, facilitates the walkthroughs. Our business continuity planning service runs exactly that structure.
From blank template to tested plan
The template costs nothing; the value arrives when the answers are honest, the numbers are verified, and the first walkthrough has flushed out the surprises. We run that whole process for Scottish SMEs, starting with a free IT health check that tests the claim every continuity plan depends on: that your backups restore, in a time you can live with. Get in touch and build the plan your insurer thinks you already have.
