How to Write a Business Continuity Plan for a Small Business

What is a business continuity plan, and why does a small business need one?

A business continuity plan is the short document your team uses to keep critical activities going, or bring them back in time, when something stops them: a fire, a flood, a power cut, a cyber attack, a supplier failing, a key person leaving. It sits on top of a programme of analysis, decisions and practice. The document is the visible part, not the whole thing.

Small companies need it more than large ones, not less. A company with one site, one main supplier, one server and one person who knows the passwords has no spare capacity. A bank can move work to another office; a 40-person firm without a plan phones people and hopes.

The threats are well documented. The Allianz Risk Barometer 2026, based on 3,338 risk experts in 97 countries and territories, ranked cyber incidents as the top global business risk for the fifth year running, with business interruption third. The UK government's Cyber Security Breaches Survey 2026 found that 43% of UK businesses identified a breach or attack in the previous twelve months, while only about a quarter had a formal incident response plan.

What are the steps to write a business continuity plan?

The international standard for business continuity management, ISO 22301, and the Business Continuity Institute's good practice describe the same arc in different words: understand the organisation, decide how to respond, write it down, validate it, and keep it current. For a small company that arc fits into about eight weeks of part-time work. The table below sets it out.

How do you do a business impact analysis?

A business impact analysis (BIA) works out which activities matter most, how fast each must come back and what each depends on. Do it with the person who runs each activity, at their desk, in about 40 minutes. Ask what the activity produces, who would notice first if it stopped, and when it peaks: month end, payroll day, a shipping cut-off.

Then score the impact at several points in time, for example four hours, one day, three days, one week and two weeks, across money, customers and legal duties, reputation and safety. Watching the scores climb along the row is what turns 'we could manage for a week' into 'one day, in peak season'. Finish by listing what the activity needs (people, systems, suppliers, sites, equipment, data, utilities) and the workaround that exists today, honestly described.

• Assume the worst plausible timing, not a quiet week
• Ask who else can do the activity if the usual person is away
• Write the workaround that exists, not the ideal one
• Record anything there is only one of

What do MTPD, RTO and RPO mean in plain words?

The maximum tolerable period of disruption (MTPD) is the point after which the damage from an activity stopping becomes very hard to reverse: customers leave for good, a legal deadline passes, penalties begin.

The recovery time objective (RTO) is when you aim to have the activity running again at a minimum level. It must be shorter than the MTPD, with a margin, because recovery never goes exactly to plan. An MTPD of 24 hours with an RTO of 12 is sensible; an RTO of 24 is a bet on a perfect day.

The recovery point objective (RPO) is how much data or work you can afford to lose, measured as time since the last good copy. If orders are keyed all day and the backup runs at night, your RPO is a day. If redoing a day of work is unacceptable, back up more often. These terms come from the continuity profession and appear in ISO 22301 and in the US National Institute of Standards and Technology's contingency planning guide, SP 800-34.

Which continuity strategies work for a small company?

Once you know which activities have recovery objectives you cannot meet, choose how to close each gap. The realistic menu is short, and the cheapest options are often agreements and habits rather than purchases.

Compare at least two options for each top-priority activity by the recovery time each achieves and its cost. A simple payback test helps: estimated loss per hour, multiplied by the hours a strategy saves and by how often you expect a serious disruption, against what the strategy costs a year. Write down the options you reject and why, so you do not re-argue them next year.

Who should be on the crisis management team?

Name the roles before the names: a crisis lead who chairs and can spend money, a deputy, operations, IT and data, people and welfare, communications, finance and legal, a customer lead, a lead for each other site, and a log keeper. Every role needs a deputy who has sat in the chair in an exercise.

Then write the decision rights. What can the operations lead stop without asking? How much can the crisis lead spend without the board? When does the deputy take over if the lead cannot be reached? Questions like these are easy in daylight and very hard at three in the morning. The log keeper has no decision rights and misses nothing: the log is the memory of the response and the evidence for insurers and regulators.

What should a crisis communication plan include?

Every audience should hear from you before they hear about you: staff first, because staff talk to everyone, then key customers, suppliers, your insurer and bank, any regulator, and the media and social media if attention is likely. Prepare numbered templates for each and pre-approve the holding statements, so on the day only the blanks need filling.

Four rules keep crisis messages safe. Say what you know, what you do not know yet, and when you will update. Never speculate about cause, blame or cost. Speak with one voice outside: only the crisis lead or a named spokesperson talks to the media and regulators. Approve and log every external message. Data breach notification clocks can start in the first hours of a cyber incident and differ by country, so involve your legal adviser early and keep current notes on the rules that apply to you.

How do you test a business continuity plan?

Exercises test the plan, not the people. Say so at the start, because people who feel judged perform rather than respond. Three types cover most needs: a tabletop, where the team talks through a timed scenario at a table for about 90 minutes; a walkthrough, where you follow a runbook on site; and a simulation, where you do real things such as running the call tree, restoring from the offline copy or moving to the alternate site.

A workable rhythm for a small company is a tabletop every six months, a call-tree test and a backup restore test every quarter, and a walkthrough per site each year. Use an observer who writes and does not play, hold a 20-minute hot debrief straight afterwards, and run a blame-free after-action review within ten working days that ends in owned, dated actions. The UK National Cyber Security Centre's free Exercise in a Box offers ready-made cyber scenarios if you want a starting point.

Exercises also show who needs to grow into a role. A short judgement assessment, such as AssessAll's Crisis & High-Stakes Decision Making, can give the crisis lead and deputies a baseline before the first tabletop.

How do you keep the plan current, and where does AI fit?

Plans decay quietly. Keep a register of every continuity document with an owner, a review interval and trigger events that force an early review: a new site, system or supplier, a key leaver, an incident, an exercise finding, a change in law. Spend fifteen minutes a week on overdue actions and a half day a year with leadership to re-read the plan and book next year's exercises. Report a readiness score and the decisions you need each quarter on one page.

AI tools such as ChatGPT, Gemini, Claude, Copilot or your company's approved assistant are useful for drafting policies, BIA questions, scenario narratives, exercise injects, holding statements and reports. They should never decide whether to activate, pay a ransom, notify a regulator or what to tell customers. A named person checks every fact and approves, nothing sensitive goes into an unapproved tool, and the runbooks must work on paper with no AI at all.

If you want the whole programme as ready-made files, The Business Continuity and Crisis Plan Kit from Bodhih Training includes a BIA worksheet, a 14-sheet workbook, eight scenario runbooks, crisis communication templates and a tabletop facilitator guide. Exercise findings make a good starting point for personal growth too: Jobulary shows how to turn them into a development plan for each member of the crisis team.