A business continuity plan (BCP) is a short, written document that explains how your business keeps operating, or gets back to operating, when something disrupts it: a fire, a power cut, a ransomware attack, a supplier failure, or the sudden loss of a key person. For a small business it does not need to run to eighty pages. A few clear pages that people can find and follow under pressure are worth far more than a thick binder nobody has read.
Why does a small business need one?
Small businesses usually have little slack. One owner, one premises, one main system, and a handful of customers who expect you to be there tomorrow. A plan will not prevent incidents, but it shortens the confusion that follows them, protects revenue and customer trust, and is increasingly requested by larger customers, insurers and lenders.
Step 1: Identify your critical functions
Start by listing what the business actually does day to day, then mark what would hurt most if it stopped. Typical candidates:
- Revenue-generating work: delivering products or services, taking orders, running the shop or site.
- Getting paid: invoicing, payment processing, and collecting overdue accounts.
- Paying others: payroll, suppliers, tax and rent.
- Communication: phone, email, and the channels customers use to reach you.
- Legal and safety duties: anything you must keep doing to stay compliant or keep people safe.
For each function, note which people, systems, suppliers and locations it depends on. That list of dependencies is the raw material for everything else.
Step 2: Run a simple risk assessment
You do not need a formal methodology. For each critical function, ask what could realistically interrupt it and score two things from one to five: how likely it is, and how severe the impact would be. Multiply the scores and tackle the highest numbers first. Common scenarios include:
- Loss of premises through fire, flood or a blocked building.
- Power, internet or phone outage.
- Cyber incident, data loss or a failed device.
- A key supplier or software provider going offline.
- Illness, resignation or absence of a key person.
Be honest about single points of failure, such as the one person who knows the passwords or the one supplier with no alternative.
Step 3: Set recovery time objectives
A recovery time objective (RTO) is the longest you can tolerate a function being down before the damage becomes unacceptable. Set one for each critical function, in plain units such as two hours, one day or one week. A related figure is the recovery point objective (RPO): how much recent data you can afford to lose, which tells you how often backups must run. Short targets cost more to achieve, so let the numbers guide where you spend: invoicing may tolerate a day, while taking customer orders may not.
Step 4: Assign roles and keep contacts current
In an incident, the worst problem is often not knowing who decides. Name a plan owner, a deputy for each role, and a clear order of authority. Then record:
- Staff contacts: mobile numbers and a personal email, not just work accounts that may be down.
- Key external contacts: suppliers, landlord, insurer, bank, IT provider, accountant and utilities.
- Customer communication: who tells customers what, through which channel, and with what holding message.
Keep a printed or offline copy somewhere accessible, because the plan is useless if it lives only on the system that has failed.
Step 5: Plan backups and workarounds
For each critical function, write down the fallback. That usually means a mix of data backups and manual or alternative ways of working:
- Data: keep at least one copy off-site or in the cloud, keep one copy that cannot be changed or deleted by an infected machine, and check that restores actually work.
- Systems and access: store critical credentials securely, with a way for a second trusted person to reach them.
- Premises and equipment: a remote-work option, a reciprocal arrangement with another business, or spare hardware for essentials.
- Suppliers: an approved alternative for anything you cannot do without.
- Cash flow: enough reserve or credit to cover payroll while income is disrupted, and a review of what your insurance really covers.
Step 6: Test the plan
An untested plan is a guess. Start with a short tabletop exercise: gather the team, describe a scenario such as “the office is inaccessible on Monday morning”, and walk through who does what. Note every gap, such as an out-of-date number or a missing password. Then test the technical parts separately, especially restoring a backup. Even one realistic exercise a year will expose problems that are far cheaper to fix now.
Step 7: Review on a schedule
Plans decay quickly. Review yours at least once a year, and again whenever something material changes: a new system, a new location, a key hire or departure, a major supplier change, or after any real incident or test. Record the date, the version and who approved it, and brief new staff on their role as part of onboarding.
If you want the plan to live somewhere your team already works, FulcrumGrid Command Center can hold your key tasks, owners and deadlines in one place, which helps with the dependency list and the review reminders. It is a coordination aid, not a substitute for the thinking above: the value of a continuity plan comes from the decisions you make in it, and from rehearsing them before you need them.
Frequently asked questions
What is a business continuity plan?
It is a short written plan describing how a business keeps running, or recovers quickly, when something disrupts it, such as a fire, outage, cyber incident or the loss of a key person. It covers critical functions, recovery targets, roles, contacts, backups and testing.
How long should a small business continuity plan be?
As long as it needs to be to be usable, and for most small businesses that is a handful of pages. Clarity matters more than length: people must be able to find it and follow it quickly during an incident.
What is a recovery time objective (RTO)?
It is the longest a function can be unavailable before the harm becomes unacceptable. You set one for each critical function, for example two hours for taking orders or one day for invoicing, and it guides how much you invest in backups and alternatives.
How often should I test and review the plan?
Review it at least once a year and whenever something important changes, such as a new system, location or key person. Run at least one tabletop exercise a year, and test restoring your backups on a regular schedule.
Is a business continuity plan the same as a disaster recovery plan?
Not quite. A continuity plan covers keeping the whole business operating, including people, premises and suppliers. A disaster recovery plan is usually the narrower technical part focused on restoring IT systems and data.
FulcrumGrid Command Center
Keep your continuity plan owned, current and visible
FulcrumGrid Command Center gives your team one place to track owners, tasks and review dates, so your continuity plan stays up to date instead of sitting forgotten in a folder.