How to write a business continuity plan for a small business

Begin with the work, not the technology

Ask the owner and a person from each important role to describe a normal working day. Choose the activities whose interruption would quickly affect customers, income or safety. Receiving enquiries, accessing current records and paying suppliers are possible examples, not a universal priority order.

For each activity, identify the smallest useful version you could keep doing during an interruption. Taking a callback number may be enough while a booking system is checked. A task that cannot safely proceed without the full record needs a different decision. Write down who can authorise that decision.

Set a target and identify the dependencies

Agree how long the activity can be unavailable and how much recent work you can tolerate losing. Those are the recovery time objective and recovery point objective. Treat them as requirements to test, not figures to copy from a supplier's brochure.

List the people, records, devices, accounts, internet connection and suppliers behind the activity. Check whether an alternative uses the same sign-in or building. A second application is not a separate fallback if nobody can open it during the incident you are planning for.

Keep the first instructions short

Put the immediate actions and contacts on two pages. Keep supporting inventories elsewhere and explain where they can be found. Staff should not need to search through a long policy before deciding whom to call.

Make it usable when the normal tools fail

Keep an approved copy outside your main cloud account and decide which staff need access. Check that contact numbers are current and that the deputy knows where the copy is. Protect confidential information without making the emergency instructions impossible to reach.

Describe workarounds for email loss, loss of premises, a missing key person and an unavailable supplier. Tell people what not to do, including using personal accounts or moving sensitive records into an unapproved service. Make temporary record keeping and later reconciliation part of the plan.

Exercise and improve the plan

Once a year, ask a deputy to work through a realistic scenario. Record unanswered questions, inaccessible information and tasks that depend on the usual administrator. Assign an owner and date to each correction. Review again after a system change or incident rather than waiting for the annual exercise.

The ICO's data security guidance says testing results should be documented and recommendations acted on or their rejection justified. Read ICO data security guidance.

What we can do for you

We help you agree priorities, document workarounds and check the recovery arrangements. Continuity planning is quoted as a fixed fee after a free 30 minute call. The technical fallbacks use our standard prices.

Monthly starting prices exclude VAT and use a 3 year term billed monthly. Shorter terms cost a little more. Your price and the actual fallback arrangements are confirmed in a written quote.

Questions about this service

Free tools to help you prepare

• Free business continuity plan template for small businesses