Business Continuity Plan for a Small Business: A Working Template

Work through these in order, and keep each output to a page or less:

1. List critical functions. Write down what the business must do to bring in cash and serve customers: take orders, fulfill, invoice, pay staff, answer support.
2. Map dependencies. For each function, note the systems, people, vendors and locations it relies on.
3. Set recovery targets. For each function, decide how long it can be down before real damage happens, and how much recent data you can afford to lose.
4. Identify likely disruptions. Think through the ones that could really happen to you: a cloud service outage, a power or internet failure, a key employee leaving, a supplier failing, a cyber incident, a facility closure.
5. Write playbooks. For each high-priority risk, write the first steps, the owner and the backup owner.
6. List contacts. Include staff, vendors, insurers, your bank, your attorney and your IT provider, with a second way to reach each.
7. Test and schedule review. Run a short exercise and put a yearly review on the calendar.

Downtime tolerance is easiest to reason about when you turn availability percentages into time. Availability targets translate to a yearly downtime allowance: 99.9% allows roughly 8.76 hours a year, while 99.99% allows about 52.6 minutes¹.

Most small businesses don't need numbers that tight for every function. Ask a simpler question: how many hours can we go without this before a customer notices, and how many before we lose money we can't recover? Say your order system can be down for four hours before orders are lost, but your payroll system can be down for two days. Those are different targets, and they justify different spending.

Also decide how much recent data you can afford to lose. If your last backup ran overnight, you might lose a whole day of orders in a failure. Whether that's acceptable is a business decision, not a technical one.

Keep playbooks short enough to read under stress. Each one needs:

• Trigger: how you'll know it's happening, such as "the order system shows errors for more than 15 minutes".
• First 30 minutes: the immediate steps, in order, with the person responsible for each.
• Workaround: how to keep serving customers manually, such as taking orders by phone with a paper form.
• Communication: who tells customers, staff and partners, and what the message says.
• Recovery and return to normal: how you'll confirm the system is really back, and who signs off.
• After-action note: what you'll write down afterward so the plan improves.

Pre-write customer and staff messages with blanks for the details. Nobody writes well during an outage.

Systems fail loudly. People risk arrives quietly. Identify anyone whose absence would stop a critical function, and give each of them a named backup and written procedures. A short review of who alone knows or controls what is a quick way to find these gaps. Pay attention to access as well: passwords, admin rights and vendor accounts held by one person are a continuity problem.

For locations, decide where work happens if your office or shop is unavailable. For many teams the answer is remote work, which depends on having laptops, VPN or cloud access and a way to forward phones. If you have physical inventory or equipment, ask your insurance broker what's covered and how to document it. Insurance and legal requirements differ by state and industry, so confirm them with your broker or attorney.

An untested plan is a guess. Start with a tabletop exercise, which takes about an hour. Pick one scenario, such as your main software being down for a day, and walk through the playbook with the people who would act. Note every place someone says "I'm not sure who does that."

Then, once a year, run one practical test: restore a file from backup, switch to your manual order process for an hour, or call every number on the contact list. Fix the gaps and update the plan.

Store the plan where it's reachable when your main systems are down. A copy only on your company laptop or shared drive won't help if those are what failed. Keep a printed or offline version with the contact list, and document the rest in a shared workspace such as Notion. Track the yearly review and the drills in a task tool like Asana with recurring tasks.

Continuity work overlaps with other routines. Your operations audit checklist can include a yearly review of the plan, and your employee handbook should tell staff what to do during an incident. If you're choosing a place to keep the documentation, compare options in documentation tool comparison. For more technical planning on systems, read the guide on disaster recovery and business continuity operations.