Writing a business continuity plan

What a continuity plan is for

A business continuity plan answers a simple question: if something serious happens, how do we keep serving customers and paying our people? The disruption might be a ransomware attack, a flood, a wildfire evacuation, a long power outage, the loss of a key supplier or the sudden absence of a critical staff member. The plan focuses on outcomes rather than on any single cause.

Many organizations confuse continuity planning with having backups. Backups are essential, but they are only one piece. A useful plan also covers people, communication, decision-making, alternate work locations and the order in which systems should be restored. It should be short enough that people will actually read it under pressure.

Identify what matters most

Start by listing your critical business functions, such as serving customers, taking payments, running payroll and meeting regulatory deadlines. For each one, note which systems, people and suppliers it depends on, and how long the business could tolerate it being unavailable before the damage becomes serious. Involve managers from each area, since they know the dependencies best.

These tolerances drive your IT decisions. If you can manage without your accounting system for a week but not without phones for more than an hour, your investment should reflect that. Your IT provider can translate these business requirements into recovery time and recovery point targets for each system and explain what it would cost to meet them.

What to include

A practical plan for a small organization can fit in ten pages or fewer. Use plain language, checklists and contact lists rather than long narrative. Write for the person who will be reading it at two in the morning during an emergency, who may not be the person who wrote it and who may be working from a phone.

Make sure the plan also identifies who can authorize spending during an emergency, since replacement equipment, temporary office space or outside specialists may be needed quickly. Set reasonable spending limits in advance, and record how decisions will be documented so that insurance claims and later reviews have the information they need. Clear authority prevents delays at the moment when quick decisions matter most.

• Roles and who makes decisions, with backups for each person
• Contact lists for staff, customers, suppliers, insurer and IT provider
• Critical functions and their recovery priorities
• How staff will work if the office is unavailable
• Communication templates for staff, customers and media
• Links to your incident response and disaster recovery procedures

Link it to IT recovery

The continuity plan should point to a more detailed IT disaster recovery plan that describes how each system is restored. That plan covers backup locations, restore steps, the order of recovery and the credentials and vendor contacts needed. It is usually maintained by your IT provider but should be reviewed and approved by the business.

For cyber incidents specifically, an incident response plan explains how to contain an attack, preserve evidence, involve your insurer and lawyer and meet notification obligations under PIPA, the HIA or other legislation that applies to you. These three documents work together, and staff should know where to find all of them.

Test, store and update

A plan that has never been tested is mostly theory. Run a tabletop exercise at least once a year, walking through a realistic scenario such as ransomware or an evacuation with the key decision-makers in the room. These exercises are inexpensive and almost always reveal gaps, such as outdated contacts or an assumption that a particular system can be restored quickly.

Store copies of the plan where you can reach them when your systems are down, including printed copies at home and on personal phones. Update it after every exercise, real incident and significant change in your business, such as a new office, major system or key personnel change. Assign one person to keep it current.