Template preview · Operations
Business continuity plan
Prepare a practical path to continue critical work through disruption.
A continuity plan for a fictional organization.
Sample purpose
Prepare a practical path to continue critical work through disruption.
Audience: Operations director, Risk manager- Structure
- 4 sections
- Criteria
- 14
- Sources
- 9
- Watches
- 4
- Default approach
- Review first
Set the purpose first. Then change every section, criterion, and agent setting before anything runs.
Fictional sample
Structure and criteria
Sample content shows the shape of a useful document. Copying it is optional.
01 Review firstCritical services
For this business continuity plan, ranks services by impact and recovery time objective.
Criteria
- Each service has a minimum level and an RTO with its basis: exercise result, SLA or accepted risk.
- Ranking explains dependencies, such as intake restores before payments.
- States what happens downstream if the RTO is missed.
- Minimum service does not rely on the disrupted site or system.
Sources
- NIST SP 800-34 contingency planning csrc.nist.govRTO and priority method.
- Ready.gov business continuity ready.govPublic continuity planning guidance.
- Harbor outage history (fictional) api.harborregistry.examplePast outage durations and cascades.
Sample content
Critical service Minimum service Recovery target Lead Permit intake Accept urgent requests by phone 4 hours Owen Grant Status notices Post one public update per day 8 hours Dana Lee 02 Review firstDisruption response
For this business continuity plan, assigns roles, alternate channels, and safe workarounds.
Criteria
- Each action names a person, not a title, with training dated in the last 12 months.
- Workarounds avoid anything the stated scenario takes down.
- Each notification has a primary, secondary and no-system fallback channel.
- Says what happens when the assigned person is unreachable.
Sources
- CISA incident response cisa.govCoordination and communication practice.
- NWS active alerts api.weather.govLive regional alerts that shape the scenario.
- Harbor training log (fictional) api.harborregistry.exampleWho has practised which role.
Watches
- Checks api.weather.gov daily
- Follows Critical services
Sample content
- ☐ Move intake roster to approved backup workstation
- ☐ Use the published phone script and log each case number
- ☐ Notify records lead before restoring the primary system
03 ManualRecovery sequence
For this business continuity plan, lists restoration order, dependencies, and validation.
Criteria
- Each step names the step or data state it waits for.
- Each phase names its reconciliation, such as comparing the backup log with requests received.
- Each step has a validation signal that can be observed.
Sources
- Harbor exercise results (fictional) api.harborregistry.exampleMeasured recovery milestones.
- USGS significant earthquakes earthquake.usgs.govReal hazard feed for scenario realism.
Watches
- Follows Disruption response
Sample content
- 2026-10-06 · Office closure beginsOwen activates remote intake and assigns two coordinators.
- 2026-10-07 · Restore checkDana reconciles backup log against received requests.
- 2026-10-08 · Return to normalRecords lead verifies outstanding cases.
04 Review firstExercise and revision
For this business continuity plan, records exercise result and plan changes.
Criteria
- Latest exercise has date, scenario and measured time per milestone.
- Measured time sits beside each target, and any miss records a decision.
- Each plan change cites the finding behind it and its owner.
Sources
- Harbor continuity reviews (fictional) api.harborregistry.exampleExercise reports and improvements.
Watches
- Follows Recovery sequence
Sample content
- Urgent requests acknowledged
- Within 4 hours
- Public status update
- Daily by 16:00