Other cookies are configurable.
Business continuity plan template
The section by section structure of a professional continuity plan, aligned with ISO 22301, and how to adapt it to your organisation.
A good business continuity plan template is a disciplined structure, not a form to fill. The sections below reflect the plans we write and audit for clients across banking, industry, healthcare and government. Use them as the skeleton, and build each section from your own business impact analysis.
The twelve sections of a professional BCP
- Purpose and scope. What the plan protects, which sites and activities it covers, and what it deliberately excludes.
- Invocation criteria and authority. The triggers for activation and the named roles authorised to invoke, with deputies.
- Roles and responsibilities. The response structure: incident lead, communications, operations, welfare, log keeper.
- Critical activities and recovery objectives. Each critical activity with its recovery time and recovery point objectives, from the BIA.
- Immediate response actions. The first hour, as short numbered steps: safety, assessment, invocation, notification.
- Continuity strategies. How each critical activity keeps running: alternate site, homeworking, manual workaround, alternate supplier, failover.
- Recovery procedures. Activity by activity instructions to restore normal operations, each with a named role.
- Communications. Who informs staff, customers, suppliers, regulators and media, with pre agreed holding statements.
- Contact and resource directories. Response team, staff cascade, suppliers, authorities, and the resources each strategy needs, kept as maintained appendices.
- Dependencies and single points of failure. The systems, sites, people and suppliers the plan assumes, stated honestly.
- Stand down and return to normal. Criteria and authority for de-escalation, debrief and post incident review.
- Maintenance and exercise record. Version control, review schedule, exercise history and open corrective actions.
Keep the plan body stable and the volatile data, contacts, suppliers, system inventories, in appendices that are reviewed quarterly. That is what keeps a plan alive between annual reviews.
Want the structure as a working document?
We provide our full template, with guidance notes in every section, to clients at the start of an engagement, and we are glad to share it with organisations that are serious about doing the work. Book a consultation and we will walk you through it against your own situation, at no cost and with no obligation.
Can I just download a free BCP template and fill it in?
A template gives you structure, not continuity. The value is in the analysis behind each section: which activities are critical, what they depend on, and which strategies you have chosen. A filled in template that skips that analysis reads well and fails on the day. Use the structure below, but do the work behind it.
How long should a business continuity plan be?
As short as it can be while remaining executable. Many strong plans are 15 to 30 pages plus appendices for contact lists and recovery procedures. If responders cannot find the right page in thirty seconds, it is too long or badly structured.
Does the template satisfy ISO 22301?
The structure below is aligned with what ISO 22301 expects a plan to contain. Certification, however, assesses the management system around the plan: leadership, analysis, exercising, audit and improvement, not the document alone. See our page on the business continuity audit.
Start from a structure that has survived real incidents.
Book a short call and we will review your current plan, or help you build one from this structure. We respond within 24 hours.
Book a consultation