Business continuity plan (BCP) for your team: fill in and print

Last updated: 27 October 2026 · IT-Checklist editorial team

A business continuity plan (BCP) describes how your business keeps going when something big fails. A fire at the office, for example, a day without power, a cloud outage or a key supplier going bankrupt. The emergency plan is for the first hours after a cyber attack. This plan is for the days and weeks after that, and for any kind of disruption.

Fill it in with your team. Start with one question: which work can't stop for more than a day? Then print it and keep a paper copy at the office and at home. Test it at least once a year and update it when something in your business changes.

What you type in the fields is included in the print. Nothing is stored, so print or save the PDF before you close the page.

Rather fill it in on your computer? Download the blank PDF with form fields, fill it in with a PDF reader such as Adobe Acrobat Reader and save it.

IT-Checklist

www.it-checklist.com/business-continuity-plan

Business continuity plan

CompanyVersion and dateOwner of this planNext review

1. Purpose and scope

Which part of the business does this plan cover? One location is fine to start with. You can expand later.

Which locations, teams and services does this plan cover?When do we activate the plan? (e.g. office unusable for more than 4 hours, core system down for more than 1 day)When do we deactivate the plan, and who decides?

2. The continuity team

In a small business one person sometimes has two roles. That's fine, as long as every role has a backup.

Role	Name	Phone	Backup
Lead: decides and activates the plan
IT and systems
Communication with customers and press
Staff and HR
Money, bank and insurance
Office, building and equipment
Log keeper: records every decision

3. Most important work (impact analysis)

Write down your most important processes, such as taking orders, delivering, invoicing and paying salaries. How long can each one stop before you really feel it? And how much work can you afford to lose, for example the last 4 hours? That tells you how often to make a backup.

Process	Max. downtime	Max. data loss	Needs: systems, people, equipment

4. Scenarios: what do we do if...

For each scenario, write down briefly how you keep working and who arranges it.

Scenario	How we keep working	Who arranges it
Office unusable (fire, water, no access)
Power cut for a day or longer
Internet or phones down
IT systems or cloud down (ransomware, outage)
Key supplier fails
Many colleagues ill or absent at once
Key person cannot be reached

5. Fallback location and emergency kit

Fallback location

AddressContact and phoneAccess or key held byRoom for how many people

Everyone can work from home and knows the rules for doing that securely.
At least one spare laptop is ready with the latest updates.
There is a mobile hotspot (4G/5G) for when the office internet goes down.
There is a paper contact list of colleagues, customers and suppliers.
A backup is kept outside the office, and we have tested that restoring it works.
Important passwords and codes can be found when the admin is away, e.g. in an emergency safe or a password manager with emergency access.
There is a printed copy of this plan, the emergency plan and the incident response team plan.

6. Suppliers and agreements

Which parties can't you do without? For example your IT partner, hosting, internet, software, the bank and your main supplier. Agree in the contract (SLA) how fast they help and who restores what.

Supplier	Service	Phone (also at night)	Customer number and SLA

7. Communication during the disruption

Who informs colleaguesThrough which channel (e.g. text or chat group)Who informs customersWho talks to the press

We have a fallback channel for when email and Teams are down, e.g. a chat group or text list with private numbers.
A short standard message for customers is ready. It says what is going on, what it means for them and when they will hear from us again.
We know which reports are mandatory and where the emergency plan covers them. A data breach, for example, goes to the Dutch Data Protection Authority within 72 hours.

8. Activating the plan: the first day

The lead activates the plan and writes down the time and reason.
The continuity team meets, on site or online through the fallback channel.
First make sure everyone is safe.
Decide which processes from step 3 must run again first.
Have the log keeper write down every decision with the time.
Inform colleagues, then customers and suppliers, using the standard message.
Is it a cyber attack? Follow the emergency plan first and call the incident response team.
Agree on fixed times to catch up, e.g. every morning and every afternoon.

9. Recovering and back to normal

Restore systems in the order of step 3: the most important first.
After restoring, check that the data is complete and correct.
Clear the backlog that built up during the disruption, such as orders and invoices.
Only deactivate the plan when the team decides together, and tell everyone.

10. Testing and upkeep

Last exerciseNext exercise

We exercise the plan at least once a year, e.g. with a one-hour tabletop exercise.
We update the plan after a move, new software, a new supplier or new staff.
After every disruption or exercise we discuss what went well and what can be better.
New colleagues know this plan exists and where it is kept.