Business Continuity Plan Template for Small Businesses (Free Word and PDF)
Every business depends on its IT systems. Email, cloud storage, accounting software, customer databases, phone systems. When any of these go down, work stops. Revenue stops. Client trust erodes. And for a small business without a plan, even a short outage can turn into a serious problem.
A business continuity plan is the document that tells your team exactly what to do when something goes wrong. It identifies your most critical systems, sets out how quickly each one needs to be restored, and gives everyone a clear set of steps to follow so that a bad situation does not become a catastrophic one.
This guide walks you through how to build a practical business continuity plan with a particular focus on IT, because for most small businesses in 2026, IT is the backbone of every operation. It includes a free business continuity plan template you can download, fill in, and start using straight away.
Business Continuity Plan Example
This is what the first two sections of the template look like once they are filled in, for a 15 person accountancy practice whose staff work from one office and from home. The practice listed everything it does, kept the five functions that would hurt within a week, and set a recovery time and a recovery point for each.
| Function | Depends on | RTO | RPO | Can we meet it today? |
|---|---|---|---|---|
| Client email and Teams | Microsoft 365, internet access, staff sign-in and MFA | 4 hours | 24 hours | Yes |
| Client files | SharePoint and OneDrive, a separate backup service | 4 hours | 8 hours | Yes, backed up three times a day |
| Tax and practice management software | The supplier's cloud platform, internet access | 1 working day | 24 hours | Unknown: the contract does not say how the supplier backs up |
| Payroll for clients | Payroll software, HMRC online services, the payroll lead | 1 working day in run week | 24 hours | Only if the payroll lead is available |
| Phones | Cloud phone system, internet access | 2 hours | Not applicable | No: no call diverts are set up |
RTO is how long the function can be down. RPO is how much recent data the practice could afford to lose and recreate.
The last column is the one that matters. Three of the five rows turned into actions: ask the software supplier in writing how and how often it backs up client data, train a second person to run payroll, and set up call diverts to mobiles that the office manager can switch on from anywhere. None of the three costs much, and the practice would not have found any of them without writing the table down.
What Is a Business Continuity Plan?
A business continuity plan (often shortened to BCP) is a document that sets out how your organisation will keep operating during and after a disruptive event. It covers everything from who makes decisions during a crisis, to which systems get restored first, to how you communicate with staff and clients while things are being fixed.
The disruption could be anything: a ransomware attack that locks your files, a server failure that takes your email offline, a flood that makes your office unusable, or a key supplier going out of business overnight. The cause matters less than the outcome. In almost every scenario, you lose access to one or more of the following: your premises, your people, your IT systems, your data, or your supply chain.
A good business continuity plan does not try to prevent every possible incident. That is what your cybersecurity controls, insurance policies, and health and safety measures are for. Instead, it accepts that incidents will happen and provides a structured way to respond, recover, and get back to normal with the least possible damage.
Why Small Businesses Need a Business Continuity Plan
There is a common assumption that business continuity planning is something only large enterprises need to worry about. That assumption is wrong, and it is particularly dangerous for smaller organisations.
A large company with 500 employees and a dedicated IT department can absorb a two day outage. They have redundant systems, multiple offices, and the financial reserves to weather the disruption. A small business with 15 people and one office does not have that luxury. When the systems go down, the entire operation stops.
The UK government's Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a breach or attack in the previous twelve months. For medium sized firms, the figure was 65%. The average cost of a breach for a small business runs into thousands of pounds when you factor in lost revenue, recovery costs, and reputational damage. The recent Jaguar Land Rover ransomware attack showed just how quickly a cyber incident can cascade through an entire supply chain.
Beyond the financial argument, there are commercial and regulatory reasons to have a plan in place. Clients and supply chain partners increasingly expect to see evidence of continuity planning during due diligence. Government contracts may require it. Insurers look favourably on businesses that can demonstrate they have a tested plan. And under UK law, company directors have a duty to exercise reasonable care and skill, which includes preparing for foreseeable risks.
A business continuity strategy does not need to be complicated. For most small businesses, it starts with a single document that identifies the critical systems, sets realistic recovery targets, and gives your team a clear set of instructions. The point is not to create a 50 page report that nobody reads. It is to produce something practical that your people can actually use under pressure.
It is also worth noting the connection to frameworks like Cyber Essentials and ISO 22301. Cyber Essentials, the UK government backed cybersecurity certification, now explicitly references backup and recovery as part of its controls. ISO 22301 is the international standard for business continuity management, and while certification is not required for most SMEs, understanding its principles will strengthen your plan. If you are pursuing Cyber Essentials certification, having a documented business continuity plan demonstrates a level of operational maturity that assessors and clients notice.
Business Continuity Plan vs Disaster Recovery Plan
These two terms are often used interchangeably, but they are not the same thing.
A business continuity plan is the broader document. It covers how the whole business keeps running during a disruption, including non IT considerations like alternative premises, staff communication, and client management.
A disaster recovery plan is a subset of the business continuity plan that deals specifically with restoring IT systems and data after an incident. It covers your backups, your recovery procedures, your failover systems, and the technical steps needed to get your infrastructure back online.
For most small businesses, both plans live in the same document. You do not need two separate plans unless your organisation is large enough to have distinct operational and IT recovery teams. What matters is that both aspects are covered.
How to Write a Business Continuity Plan
Step 1: Identify Your Critical Business Functions
Start by listing every function your business performs and ranking them by how critical they are. Ask yourself: if this function stopped working right now, how long could we survive without it?
For most small businesses, the critical functions include: processing customer orders, sending and receiving email, accessing your CRM or client database, making and receiving phone calls, running payroll, and accessing your accounting system. Everything else, while important, can usually wait a few days.
Step 2: Conduct a Business Impact Analysis
A business impact analysis looks at each critical function and asks: what happens if we lose it? How much does it cost us per hour? Per day? What are the knock on effects for clients, staff, and revenue?
This is where you define two essential metrics that will drive every recovery decision you make.
Recovery Time Objective (RTO) is the maximum amount of time a system can be down before the impact becomes unacceptable. For email, your RTO might be four hours. For your website, it might be 24 hours. For a backup phone system, it could be one hour.
Recovery Point Objective (RPO) is the maximum amount of data you can afford to lose, measured in time. If your recovery point objective is one hour, you need backups running at least every hour. If your RPO is 24 hours, daily backups are sufficient. Getting this number right is critical because it determines the frequency and type of backup solution you need.
Document both metrics for every critical system. They will determine what backup solutions you need and how much you should invest in redundancy.
Step 3: Assess Your Risks
List the threats that could disrupt each critical function. For IT systems, the most common threats for UK small businesses include: ransomware and malware attacks, hardware failure (server, firewall, or switch), internet connectivity outage, cloud service provider downtime, loss of a key IT person or supplier, power failure, and physical damage to premises from flood, fire, or theft.
For each risk, estimate the likelihood (how often could this realistically happen?) and the impact (how severely would it affect your business?). This does not need to be a sophisticated risk matrix. A simple high, medium, or low rating for each is enough to prioritise your planning.
Step 4: Document Your Recovery Procedures
This is the core of your plan. For every critical system, write down exactly how it will be recovered. Be specific. Do not write "restore from backup." Write "contact [name] at [provider] on [phone number], request a restore of the [system name] backup from [location], estimated restore time is [X] hours, verify by [testing method]."
Your recovery procedures should cover the following for each critical system: who is responsible for initiating the recovery, what steps they need to follow, who to contact (internal and external), what credentials or access details are needed, how to verify the system is working correctly after restoration, and what to communicate to staff and clients during the outage.
For businesses running Microsoft 365 or Azure, having a managed cloud provider who handles your backup configuration, failover, and restore procedures means you are not scrambling to figure it out during an incident.
Step 5: Build Your Contact List
Create a single reference sheet with every contact your team might need during an incident. This should include your IT support provider or MSP and their out of hours number, your internet service provider, your cloud service provider (Microsoft 365 admin, Azure, AWS), your insurance company and policy number, key staff members and their personal mobile numbers, your accountant, your landlord, and any critical suppliers.
Print this list and keep a copy somewhere accessible outside your office. If your office is the problem, you need to be able to reach these contacts from anywhere.
Step 6: Plan for Communication
When systems go down, the first question from every staff member and every client is: what is happening and when will it be fixed? If you do not have a communication plan, you will spend the first hours of an incident fielding calls and emails instead of fixing the problem.
Decide in advance: how will you notify staff if email is down (a WhatsApp group, a phone tree, a text message service)? Who is responsible for updating clients? What is the holding message for your phone system? Do you have a status page or alternative communication channel you can activate?
Step 7: Test Your Plan
A business continuity plan that has never been tested is a business continuity plan that will not work when you need it. Testing does not need to be dramatic. Start with a tabletop exercise: gather your key people around a table, present a scenario ("our email has been down for three hours and we cannot access SharePoint"), and walk through the plan step by step.
Does everyone know their role? Are the contact numbers correct? Can you actually reach your backup provider? Is the restore procedure accurate? Testing reveals gaps that look obvious in hindsight but are invisible on paper.
Test at least once a year, and after any significant change to your IT setup such as a cloud migration, a new office, or a change of IT provider.
What Your Business Continuity Plan Should Include
| Section | What It Covers |
|---|---|
| Plan Overview | Purpose, scope, who the plan applies to, version control and review dates |
| Critical Functions Register | List of business critical activities ranked by priority with RTO and RPO for each |
| Business Impact Analysis | Financial and operational impact of losing each critical function, per hour and per day |
| Risk Assessment | Identified threats, their likelihood, and their potential impact on operations |
| IT Systems Inventory | Every system, application, and cloud service your business relies on, with login details stored securely |
| Backup and Recovery Procedures | Where backups are stored, how to initiate a restore, expected recovery times, and verification steps |
| Emergency Contact List | IT provider, ISP, cloud provider, insurance, key staff, landlord, critical suppliers |
| Communication Plan | How to reach staff, clients, and partners if primary communication channels are down |
| Roles and Responsibilities | Who does what during an incident, including a named incident lead and deputies |
| Alternative Working Arrangements | Remote working setup, alternative premises, mobile device readiness |
| Testing Schedule | When and how the plan will be tested, who participates, and how findings are recorded |
| Review and Update Log | Version history, dates of review, changes made, and sign off by a senior person |
Need help putting your business continuity plan together?
Most small businesses know they need a plan but never get round to creating one. We get it. AIS Technology can review your current IT setup, identify your recovery gaps, and help you build a tested business continuity plan that actually works when you need it. No templates gathering dust, just a practical plan backed by the infrastructure to deliver on it.
The IT Recovery Side and What Most Small Businesses Get Wrong
The most common failure in small business continuity planning is not a missing plan. It is a plan that looks good on paper but falls apart in practice because the IT recovery element has not been properly thought through. Here are the mistakes we see most often.
Backups exist but have never been tested. Having a backup is not the same as having a working backup. If you have never restored from your backup, you do not know if it works. Run a test restore at least quarterly.
The 3 2 1 backup rule is ignored. If your backup drive sits next to your server and both are destroyed in a flood, you have nothing. The 3 2 1 backup rule is the industry standard for data protection: keep three copies of your data, on two different types of media, with one copy stored offsite or in the cloud. It is simple, well proven, and the single most effective safeguard you can put in place. If your current backup does not follow this rule, that should be the first thing you fix.
No one knows the admin passwords. If your IT person is unavailable and no one else can access your Microsoft 365 admin portal, your cloud firewall, or your backup management console, you are stuck. Store credentials securely and make sure more than one person knows how to access them.
The plan assumes the office is available. If your business continuity plan requires access to a physical server room and that room is the thing that has been compromised, the plan fails immediately. Build your recovery procedures around remote access as the default.
There is no relationship with a professional IT provider. When a serious incident happens, small businesses without a managed IT support relationship often find themselves at the back of the queue, calling break fix providers who have never seen their systems before. Having an MSP who already knows your setup is one of the most practical investments you can make in business continuity.
How confident are you that your backups actually work?
We regularly find businesses with backup systems that have never been tested, admin passwords that nobody can locate, and recovery procedures that assume the office is still standing. A 30 minute conversation with our team can tell you whether your IT setup would survive a real incident or fall apart under pressure.
IT Disaster Recovery Plan Template
For a small business with a few cloud systems, the IT recovery steps fit inside the continuity plan, and section 3 of our template covers them. Once you run more than a handful of systems, or an outside IT provider does the restoring, it is easier to keep the technical detail in a separate IT disaster recovery plan that the continuity plan points to. The continuity plan says what the business needs back and by when. The disaster recovery plan says how IT will get it back.
We have written a companion template for that. It is a Word document in the same style, with these sections.
| Section | What you record |
|---|---|
| Scope and invocation | Which systems and sites the plan covers, and the events that trigger it, such as ransomware, a long cloud outage or the loss of the office |
| Recovery team and contacts | A DR lead and deputy, who restores what, your IT provider, internet provider, backup provider and cyber insurer's incident line |
| Systems inventory | Every system with its dependencies, a recovery tier, an RTO, an RPO and an owner |
| Recovery order | The sequence systems come back in, and why |
| Backups and access | Where each copy of your data is held, how long it is kept, when it was last test restored, and where admin access details are stored |
| Recovery runbooks | Step by step restore instructions for each tier 1 system, with checks to run before users go back on |
| Scenario playbooks | First actions for ransomware, cloud outages, compromised accounts, loss of premises, hardware failure, internet outages and deleted data |
| Testing and maintenance | A test log and a checklist to run after every test |
The section most plans leave out is the recovery order. Systems depend on each other, so restoring a file server is no use until people can sign in to reach it. A typical order for a small business running Microsoft 365 looks like this.
- Internet connection and firewallNothing else can be reached until the connection is back.
- User accounts and multi-factor authenticationEvery other system signs people in through them.
- Email and TeamsStaff and clients need to be told what is happening.
- Shared filesRestored from backup to the most recent clean copy.
- Line of business applicationsAccounting, practice management or CRM, often with the supplier's help.
- Everything elseIn the tier order set in the systems inventory.
Download the IT disaster recovery plan template (Word)
Like the continuity template, it is free and needs no email address. Never write passwords into either document. Record where they are kept and who can reach them instead.
How Often Should You Review Your Business Continuity Plan?
A business continuity plan is not a document you write once and file away. It needs to be reviewed and updated regularly to remain useful.
At a minimum, review your plan once a year. Beyond that, you should update it whenever there is a significant change to your business: a new office, a cloud migration, a change of IT provider, new staff joining in key roles, or a new system being deployed.
Every review should check that contact numbers are still correct, recovery procedures still match your actual setup, RTOs and RPOs still reflect your current business priorities, and any lessons from incidents or tests have been incorporated.
Keep a version log at the front of the document so it is always clear when the plan was last reviewed and by whom.
If you are not sure whether your current plan reflects your actual IT setup, an independent review from an IT consultancy can identify the gaps before an incident does.
Frequently Asked Questions
What is a business continuity plan?
A business continuity plan is a document that sets out how your organisation will keep operating during and after a disruptive event. It identifies your critical business functions, assesses the impact of losing them, and provides step by step recovery procedures so your team knows exactly what to do when something goes wrong.
Is a business continuity plan legally required in the UK?
It is not a blanket legal requirement for all businesses. However, it is mandatory or strongly expected in regulated sectors such as financial services (FCA), healthcare (CQC), and organisations handling personal data under GDPR. Beyond regulation, company directors have a legal duty to manage foreseeable risks, and a tested continuity plan is strong evidence of that duty being fulfilled.
What is the difference between a business continuity plan and a disaster recovery plan?
A business continuity plan covers the whole business: people, premises, systems, suppliers, and communication. A disaster recovery plan is a subset that deals specifically with restoring IT systems and data. For most small businesses, both are covered in a single document.
Is the template available in Word?
Yes. The business continuity plan template comes as an editable Word document and as a fillable PDF, and the IT disaster recovery plan template is a Word document. Both are free and need no email address. The Word versions open in Microsoft Word, Google Docs and LibreOffice, and you can add rows or rename sections to suit your business.
How long does it take to create a business continuity plan?
For a small business with straightforward IT, you can produce a working first draft in a day if you follow a structured template. The deeper work, testing it, refining it, and getting it signed off, typically takes two to four weeks.
What is a recovery time objective?
A recovery time objective (RTO) is the maximum acceptable amount of time a system or function can be offline before the impact becomes unacceptable. For example, if your email has an RTO of four hours, your plan must be able to restore email within that window.
How often should a business continuity plan be tested?
At least once a year, and after any significant change to your IT setup. Testing can be as simple as a tabletop exercise where you walk through a scenario with your team, or as thorough as a live failover test where you actually restore systems from backup.
Download the Free Business Continuity Plan Template
We have put together a business continuity plan template for UK small businesses. It follows the structure outlined in this guide and includes prompts for every section, so you are not starting from a blank page. The Word version also has a worked example in every table.
The template is free to download and covers your critical functions register, business impact analysis, IT recovery procedures, emergency contacts, and testing schedule.
Download it, fill it in, and test it. That step alone puts you ahead of the 56% of UK small businesses that, according to the government's 2026 Cyber Security Breaches Survey, have no continuity plan that covers cyber security.
Download for Word (.docx)Download fillable PDF
No email address required. Use the Word version if you want to add rows, rename sections or keep the plan with your other policies. In the PDF, every field can be typed into and saved in any PDF reader, or printed and filled in by hand. If an outside provider restores your IT, pair it with the IT disaster recovery plan template.
If you want help building your plan, reviewing your IT resilience, or setting up the backup and disaster recovery systems that underpin it, AIS Technology can help. We support businesses across London and Essex with managed IT services, cloud solutions, and cybersecurity, including the kind of proactive monitoring and tested backup infrastructure that makes a business continuity plan actually work when you need it. Get in touch for a no obligation conversation about your continuity needs.
Tags: Business IT Support · IT Best Practices · Compliance · Disaster Recovery · Business Continuity