Business Continuity Plan: Keep Essential Work Moving

A business continuity plan is a short set of agreed steps. It names the work that must keep going during a disruption. It also says how to pause work safely when needed. It also names what the work depends on and who decides when the usual tools fail. Put people first. Then address legal duties, promises to customers, and the records behind both.

A small business can start with a table and contacts. Add the steps your risks and duties require. A short plan alone does not prove you are ready.

Picture a fictional three-person training company. It is the morning of a paid workshop. The online booking tool is unreachable. Nobody is in danger, and there is no confirmed breach. The team has ninety minutes before attendees arrive. This is a planning example, not a real event or a claim of results.

No warning signs does not mean no risk. If new signs point to a security incident, stop and use your incident response route.

What should a business continuity plan protect?

It protects essential work at three levels. Emergency response protects people. Business continuity protects the work. Technical recovery restores systems, often with specialist help. Official US preparedness guidance treats these as related but separate, coordinated with business needs (Ready.gov, 2023). Keeping them distinct helps you avoid skipping a duty that belongs at another level.

People come first. If anyone is in physical danger, evacuation and local responders take priority. This article gives no instructions for that work. If you suspect a live cyber incident, do not attempt recovery alone. Contact qualified professionals and follow your local reporting duties, which vary by country.

Australian guidance draws a similar line. It separates continuity planning from immediate emergency action and later recovery. It stresses protecting people, defining roles, keeping key information accessible, rehearsing, and updating after changes (Australian Government, n.d.). Its limit matters. It describes planning practice, not a global legal standard. No worksheet by itself satisfies your safety duties.

Which work cannot wait through a disruption?

Rank work by safety, legal duties, promises to customers, and the cost of delay. Do not rank it by revenue alone. A promised workshop this morning usually outranks an internal report due next month, even if the report earns more.

Use a business impact assessment to rank the work. For each task, ask what stops and what a delay would mean over hours or days. What is the least service you must provide? How long can it stop? How much data can you afford to lose? Base the limits on your duties and needs.

A recovery time objective is the target time to restore work. It is not a guarantee. A recovery point objective sets how much data loss, measured in time, you can accept. How often you make a backup does not prove you can restore it.

List what each key task needs: staff, authority, a site, suppliers, systems, and current records you may use. Check what the fallback itself needs to work. Two booking tools may share one payment service. If that service fails, switching tools may not help.

A key person, site, or supplier may also be out of reach. Choose a safe fallback and who may approve it.

For the training company, safe check-in and clear updates come first. New booking requests can wait for checks. Each task has different needs and time limits.

What can you safely do when a key resource fails?

Choose a safe fallback and write down its limit. Name who starts it and who can stop it.

This proposed worksheet uses the fictional training company. It is not a tested method. Read the table with the limits below it.

In the training company, the operations lead sees the booking tool is unreachable ninety minutes before the workshop. The lead confirms an approved manual method and a current secure list. After a ten-minute check, the team switches to the manual method or pauses the task safely. Ten minutes is an illustration, not a universal rule.

The founder may approve messages, refunds, or new dates only within their actual authority. Name a backup and write down what they may do. Absence does not grant new powers.

Hold new booking requests until you can check space and payment status. Do not create duplicate charges. Do not collect card details by hand.

Pause any unsafe or unverified check-in step, and do not invent access to a system. Do not add a mandatory identity check unless a real need requires one.

Keep these rules throughout: no security bypass, no password sharing, and no public spreadsheets.

Use the workshop start time to set the limit on delay. If check-in is still unsafe, contact attendees about approved new dates or refunds, subject to their rights. Do not promise the workshop will run.

Who decides and who needs an update?

Keep the plan and contacts on an approved backup channel. Record where the master copy lives, its version, its last check date, and its owner. Check what manual work costs in time and supplies. How long can the team sustain it?

Recovery planning that holds up includes named responsibilities, clear priorities, secure communication, and lessons learned (National Institute of Standards & Technology, 2024). That guidance is voluntary and written for small organizations, often with modest or no cybersecurity planning. It is not a certification, and it does not prove backups are safe.

Say what is known, what is affected, the current workaround, and the next update time. Update sooner if key facts change. Send it through a verified channel. Do not give a repair estimate you cannot support. An operational update is not a legal notice. Regulated notices may need specialist advice. Keep one approved message ready so nobody writes it under pressure.

How can you rehearse without disrupting real work?

Run a short tabletop rehearsal with a named owner and a clear stop rule. It is a discussion, not a surprise shutdown of live services. A thirty-minute session is a planning choice, not proof of readiness. Do not use real customer data or cause an outage.

Walk through one scenario. Check that staff can reach contacts and instructions through an approved backup channel. If the only copy of the plan sits inside the system that just failed, you have found your first fix. Record each gap with an owner, a due date, and the evidence you will use to retest it.

Once the first scenario is closed, test a different dependency, such as the founder being absent. One scenario does not prove the whole plan. Have skilled IT support run restore tests in a controlled, safe setting. Do not improvise a restore on a live system.

What should you check before returning to normal?

Before resuming, check the service with qualified support. Match manual records to the source system. Resolve duplicates and check promises made to customers. Tell affected people what was fixed. Record what worked, what failed, and what changed. Give each fix an owner and a due date.

Review the plan after any material change, incident, or drill. New systems, suppliers, staff, or legal duties all count. Set a review owner and a review date. Keep the extra steps your risks and duties require.

A practical template guide for small businesses links critical activities to resources, contacts, temporary locations, and communications. It also recommends reviewing the plan and storing it where the right people can reach it (Small Business Development Corporation, 2021). It is one jurisdiction's worked example, not evidence of any survival rate.

Keep two limits in view. An insurance policy and a supplier's promise do not prove a specific loss is covered or that service resumes on time. You can model the cash effect of a disruption and review customer concentration risk, but both are planning aids, not guarantees. Founder absence is a related question, though exit planning is a separate exercise. If you want a thinking partner while you build the worksheet, you can discuss advisory fit. More practical writing sits in the Mherie Vic business insights library.

This article is for informational and educational purposes only and does not constitute financial, legal, tax, medical, or professional advice. Individual results vary.