(Company Name)
Business Continuity Plan
Plan Owner Insert Name BCP Lead Insert Name
(Owner/Director/Manager)
Plan Approved By Plan Owner Electronic Date
Signature Approved
The following list includes service BC leads with authority to invoke the plan
and lead business recovery. The plan can be invoked by owner/managers.
Name Post Title Contact Details
Work Tel:
Mobile:
Work Tel:
Mobile:
Work Tel:
Mobile:
Work Tel:
Mobile:
Work Tel:
Mobile:
Work Tel:
Mobile:
INFORMATION SECURITY
When preparing, storing and invoking your business continuity plan and associated documentation it is important that you consider
and apply appropriate security to information and ICT. This is particularly important because it may be necessary to work from a
location which is not your usual place of work.
Example Business Continuity Plan Page 1
CONTENTS Page
Document Information ........................................................................................................... 3
1. Critical Services / Activities List...................................................................................... 4
2. Roles and Responsibilities.............................................................................................. 5
3. Evacuation Procedures ................................................................................................... 6
4. Grab bag ......................................................................................................................... 6
5. ACTION PLAN FOR INITIAL RESPONSE TO A SERVICE DISRUPTION ........................... 7
Initial Response Checklist ..................................................................................................... 7
6. ACTION & CONTINGENCY PLANS FOR CONTINUING CRITICAL SERVICE/ACTIVITIES . 8
Loss of People (pandemic / transport disruption / severe weather) ........................................... 8
Loss of Premise ................................................................................................................... 9
Loss of ICT ........................................................................................................................ 10
Loss of Utilities (electricity / gas / water) ............................................................................... 11
Loss of Key Supplier (interdependencies identified in your Business Impact Assessment / Risk
Assessment) ...................................................................................................................... 12
Loss of Specialist Equipment .............................................................................................. 13
7. Incident Recovery / Return to Normal Operations Checklist ......................................... 14
8. Incident Call Procedures & Contact Details .................................................................. 15
Service Contact List – Internal ....................................................................................... 155
Internal Service Interdependency Contacts ....................................................................... 15
Corporate Business Continuity Contacts ........................................................................... 15
Key Suppliers / External Interdependency Contact Details ................................................. 16
Service Procurement Cardholders .................................................................................... 16
Appendices .......................................................................................................................... 17
Appendix A: Service Area Incident Reporting Procedure ...................................................... 17
Appendix B: Expenses Log ................................................................................................ 18
Appendix C: Incident Log .................................................................................................... 19
Example Business Continuity Plan Page 2
Document Information
Version Date Revision / Amendment Details & Reason Reviewed by
<Insert for example: Draft plan created> <Insert name of
1 reviewer e.g. plan
owner>
<Insert for example: Plan amended following Business
2
Continuity Exercise
< Insert for example: Review of plan following incident
3
debrief>
Next Plan Review (Annual) Date
Last Exercise / Test (Annual) Date
Record full exercise history details on separate exercise record doc
Plan Distribution
Name Role Date
BCP Electronic storage: Please state where your plan is stored
Other storage:
List plans that will support your response to a business disruption or larger scale emergency such an
evacuation plan or corporate plan. This plan is associated with:
Plan Owner and location:
Associated BIA and RA documents (annual review)
Document Date Storage location Reviewed by
BIA or BCRA?
Example Business Continuity Plan Page 3
1. Critical Services / Activities List
Please list below in priority order (1 = most urgent) your priority services / activities you provide which you identified in your Business Impact
Analysis and Risk Assessment.
RTO (how quickly you need to be up and running with your critical functions)
MBCO (to what level of service)
RPO (aka Maximum Data Loss: point to which, in time, information must be restored to enable critical activity)
Critical Service / Function Recovery Time Minimum Business Recovery Point
Objective (RTO) Continuity Objective (MBCO) Objective (RPO)
1
Note: Business Continuity strategies improve the organisation’s resilience to a disruption by ensuring critical services or functions continue at, or
are recovered to, an acceptable minimum level (MBCO) and to timeframes stipulated by the RTO. Critical services or functions can be described
as ‘those activities whose loss would have the greatest impact in the shortest time and which need to be recovered most rapidly’.
Example Business Continuity Plan Page 4
2. Roles and Responsibilities
Using the Incident Response Checklist to identify actions, allocate actions to staff members
This table allows you to assign responsibility for completion of each task to one of your designated
roles. You will then assign each role, or multiple roles, to one or more staff members and assign
back-up staff as appropriate.
The staff members involved should then be given this table in order to understand their roles and
as a task assignment list for completion of pre-emergency planning and emergency tasks. You
should customise this table to suit your business’s needs and structure.
Role Designated Employee(s) Alternate
Team Leader Name: Bill Smith Name: John Jones
Contact Information: Contact Information:
07917 000 000 07917 001 001
Incident Responsibilities:
• ensure the Business Continuity Plan has been activated
• oversee smooth implementation of the response and recovery section of the plan
• determine the need for and activate the use of an alternate operation site and other continuity
tasks
• communicate with key stakeholders as needed
• provide important information to the relevant person for distribution
• keep key staff apprised of any changes to situation.
Role Designated Employee(s) Alternate
Strategic lead Name: Bill Smith Name: John Jones
Contact Information: Contact Information:
07917 000 000 07917 001 001
Incident Responsibilities:
• oversee smooth implementation of the response and recovery section of the plan
• determine the need for and activate the use of an alternate operation site and other continuity
tasks
• communicate with key stakeholders as needed
• provide important information to the relevant person for distribution
• keep key staff apprised of any changes to situation.
Example Business Continuity Plan Page 5
3. Evacuation Procedures
Location of locally held
Evacuation Plan
4. Grab bag
Location of locally held
service ‘grab bag’
Example Business Continuity Plan Page 6
5. ACTION PLAN FOR INITIAL RESPONSE TO A SERVICE DISRUPTION
Initial Response Checklist
This is a list of actions which should be taken in response to the initial incident. The checklist is not
prioritised or exhaustive and actions will vary depending on the nature of the incident or disruption.
All incidents will require a dynamic assessment of issues and actions required.
You will need to customise this list to include information specific to your business.
INCIDENT RESPONSE
✓ ACTIONS TAKEN
Who will:
• assess the severity of the incident? ❑
• evacuate the site if necessary? ❑
• account for everyone? ❑
• identify any injuries to persons? ❑
• contact Emergency Services? ❑
• implement your Incident Response Plan? ❑
• start an Incident Log? ❑
• activate staff members and resources? ❑
• appoint a spokesperson? ❑
• gain more information as a priority? ❑
• brief team members on incident? ❑
• allocate specific roles and responsibilities? ❑
• identify any damage? ❑
• identify critical business activities that have
been disrupted? ❑
• keep staff informed? ❑
• contact key stakeholders? ❑
• have understood and complied with any
regulatory/compliance requirements?
❑
• initiate media/public relations response? ❑
Example Business Continuity Plan Page 7
6. ACTION & CONTINGENCY PLANS FOR CONTINUING CRITICAL
SERVICE/ACTIVITIES
This section focuses on your services action plan for contingency working during disruption to key
dependencies (Premises, Staff, Suppliers/Partners, Utilities and IT). Think about what will be done
to ensure critical activities are recovered within the RTO and to the agreed level (MBCO) and the
minimum resources required to do so.
Loss of People (pandemic / transport disruption / severe weather)
PHASE 1 - ACTIONS TO BE TAKEN IN FIRST 24 HOURS
Critical Action Person Complete
Service Responsible
1 Delete on completion: Minimum staffing levels, skills,
knowledge, alternative sources of staff, temporarily
reducing or suspending less essential services/products,
multi-skilling.
2
etc
PHASE 2 - ACTIONS TO BE TAKEN DAYS 2-7
Critical Action Person Complete
Service Responsible
1
etc
PHASE 3 - ACTIONS TO BE TAKEN IN THE FOLLOWING WEEK
Critical Action Person Complete
Service Responsible
1
etc
Example Business Continuity Plan Page 8
Loss of Premise
PHASE 1 - ACTIONS TO BE TAKEN IN FIRST 24 HOURS
Critical Action Person Complete
Service Responsible
1 Delete on completion: Temporary relocation of staff to
alternative locations, flexible working options. Resources
required to meet MBCO: Adequate workspace for key
staff to operate from, emergency grab bag, essential
items to be moved.
You should consider your own alternative premise
arrangements. If the loss of premise impact is significant
enough to need to relocate, you should identify numbers
of critical staff to deliver your critical functions with a
premise requirement when completing your Business
Continuity Risk Assessment form.
2
etc
PHASE 2 - ACTIONS TO BE TAKEN DAYS 2-7
Critical Action Person Complete
Service Responsible
1
etc
PHASE 3 - ACTIONS TO BE TAKEN IN THE FOLLOWING WEEK
Critical Action Person Complete
Service Responsible
1
etc
Example Business Continuity Plan Page 9
Loss of ICT
PHASE 1 - ACTIONS TO BE TAKEN IN FIRST 24 HOURS
Critical Action Person Complete
Service Responsible
1 Delete on completion: Manual procedures or
‘workarounds’, alternative communications, data
backups, manual key contact list, staff able to agile work
2
etc
PHASE 2 - ACTIONS TO BE TAKEN DAYS 2-7
Critical Action Person Complete
Service Responsible
1
etc
PHASE 3 - ACTIONS TO BE TAKEN IN THE FOLLOWING WEEK
Critical Action Person Complete
Service Responsible
1
etc
Example Business Continuity Plan Page 10
Loss of Utilities (electricity / gas / water)
PHASE 1 - ACTIONS TO BE TAKEN IN FIRST 24 HOURS
Critical Action Person Complete
Service Responsible
1 Delete on completion: Back up power, water supply
contingencies, agile working
etc
PHASE 2 - ACTIONS TO BE TAKEN DAYS 2-7
Critical Action Person Complete
Service Responsible
1
etc
PHASE 3 - ACTIONS TO BE TAKEN IN THE FOLLOWING WEEK
Critical Action Person Complete
Service Responsible
1
etc
Example Business Continuity Plan Page 11
Loss of Key Supplier (interdependencies identified in your Business Impact Assessment /
Risk Assessment)
PHASE 1 - ACTIONS TO BE TAKEN IN FIRST 24 HOURS
Critical Action Person Complete
Service Responsible
1 Delete on completion: Alternative suppliers, multi-
sourcing, supplier contingency arrangements.
2
etc
PHASE 2 - ACTIONS TO BE TAKEN DAYS 2-7
Critical Action Person Complete
Service Responsible
1
etc
PHASE 3 - ACTIONS TO BE TAKEN IN THE FOLLOWING WEEK
Critical Action Person Complete
Service Responsible
1
etc
Example Business Continuity Plan Page 12
Loss of Specialist Equipment
PHASE 1 - ACTIONS TO BE TAKEN IN FIRST 24 HOURS
Critical Action Person Complete
Service Responsible
1 Delete on completion: Alternative suppliers, multi-
sourcing, supplier contingency arrangements.
2
etc
PHASE 2 - ACTIONS TO BE TAKEN DAYS 2-7
Critical Action Person Complete
Service Responsible
1
etc
PHASE 3 - ACTIONS TO BE TAKEN IN THE FOLLOWING WEEK
Critical Action Person Complete
Service Responsible
1
etc
Example Business Continuity Plan Page 13
7. Incident Recovery / Return to Normal Operations Checklist
You will need to customise this list to include information specific to your service.
INCIDENT RECOVERY ACTIONS
Now that the crisis is over have you:
❑
• refocused efforts towards recovery?
• deactivated staff members and ❑
resources as necessary?
• continued to gather information about
❑
the situation as if affects you?
• assessed your current financial
❑
position?
• reviewed cash requirements to restore
❑
operations?
• contacted your insurance company? ❑
• developed financial goals and
❑
timeframes for recovery?
• kept staff informed? ❑
• kept key stakeholders informed? ❑
• identified information requirements and
❑
sourced the information?
• set priorities and recovery options? ❑
• updated the Recovery Plan? ❑
• captured lessons learnt from your
individual, team and business ❑
recovery?
Example Business Continuity Plan Page 14
8. Incident Call Procedures & Contact Details
Cascade Call Tree – Internal
You may want to use a cascade call tree instead of the table below. The call tree is an excellent
method in notifying staff of any incident (e.g. if the premises that your staff work in isn’t accessible,
then staff will need to be notified to work from an alternate location. This would be done by a
manager notifying the direct subordinates. Once those staff have been notified, they would then
notify the staff under them and so on.
Contact details
Company/Department Contact List – Internal
Use this table to document your staff emergency contact details. Each service will have different
positions identified in its contact list.
Service Business Continuity team contacts
Person Contact numbers Email Role
- Bill Smith BC team leader
- John Jones Alternate BC leader
Staff / Managers
Person Contact numbers Email Role
- Joe Bloggs
- John Smith
Internal Service Interdependency Contacts
Name Contact details Service
Example Business Continuity Plan Page 15
Business Continuity Contacts
Name Role/Responsibility Contact Details
Key Suppliers / External Interdependency Contact Details
Organisation Contact Contact details
Procurement Cardholders
Name Contact details
Example Business Continuity Plan Page 16
Appendices
Appendix A: Department Area Incident Reporting Procedure
Critical Department Areas
Service Area Incident Reporting Form
Service Area: Date:
Contact: Telephone/Mobile:
Overall Status: Green Amber Red
(select only one which best
describes your services
current position)
Department operating at Department operating Department operating at
a level of ‘business as below advisable levels, a greatly reduced level.
usual’ and can deliver critical service Resources directed to
its services/products delivery/products being maintaining critical
adequately. prioritised. Minimum services/products. Risk of
standards are being met. minimum standards not
being met.
Specific company impacts
Please describe the impact on your critical services/products being experienced due to the
incident.
Critical Service/Product RAG Status (Red, Impact / issues being experienced
Amber or Green)
Do you require any additional resources at this time to enable a critical service to keep
operating at an acceptable level?
If yes, list them below (e.g. Staff, specific skills, equipment, premises etc.)
Resource Required Timescale
17
Appendix B: Expenses Log
Date Item(s)/service(s) purchased Department Cost (£) Signature
Name of staff member completing log ………………………………………………… Date………………… Page ………. Of ……….
18
Appendix C: Incident Log
Date Time Detail Action Taken Print Name
19
