how to develop a business continuity program

• Join the Team

Are Managed Services Right for You?

Managed it services, it consulting & projects.

• IT Solutions for Healthcare
• IT Solutions for Law Firms
• IT Solutions for Financial Services
• Case Studies
• Meet the Team
• Pricing & Free Assessment
• How to Set Up Email on a Mobile Device
• Get Started

Blog , Security

10 steps to a successful business continuity program.

Creating, practicing, and maintaining a successful Business Continuity Management (BCM) program requires detailed documentation, diligence, and discipline. It is an involved process that will only succeed when you have the right buy-in, and the right resources working together to develop, implement, and audit it.

“Business Continuity Planning can be described as a three-legged stool,” says Jeff Fulton , a fractional Chief Information Officer (Account Manager) at Safety Net. Jeff has decades of experience with BCP for large corporations like American Express and Time, Inc., and he is a Certified Business Continuity Professional (CBCP).

3 Legs of the BCP Stool

• Business Continuity Planning (yes, the first leg is the same as the concept itself) – All about the people, places, and processes. During an event, where do people go? What do they need to do to keep the business running? And what’s the plan for each department within an organization?
• Crisis Management – This is physical safety, employee protection, and related communications. For example, communicating with your staff during a severe weather alert, or relaying information to the fire department or law enforcement during a fire or active shooter situation.
• Disaster Recovery (DR) – The “things” part of a BCM program. How will you recover from a server failure? A network outage? A crypto virus? Do you have backups or workarounds in place? What is the priority for systems recovery in the event of a disaster?

10 Professional Process Steps

There are ten professional practice steps to a successful BCM program. Working through the steps is time consuming, but the benefits are immeasurable. Without a thorough plan in place, many organizations fail to recover from a disaster. Investing the resources to develop, practice, and revisit a BCP will put you in a position to navigate unexpected outages, natural disasters, or dangerous workplace events.

• Program Initiation and Management Establish the need for a BCM Program and identify the program components from understanding risks and vulnerabilities through development of resilience strategies, and response, restoration, and recovery plans. The objectives of this professional practice are to obtain leadership’s support and funding, and to build the organizational framework to develop the BCM program.
• Risk Evaluation and Control Identify the risks/threats and vulnerabilities that are both inherent and acquired which can adversely affect the organization and its resources or impact the organization’s image. Once identified, threats and vulnerabilities will be assessed as to the likelihood that they would occur and the potential level of impact that would result. The organization can then focus on high probability and high impact events to identify where controls, mitigations, or management processes are non-existent, weak, or ineffective. This evaluation results in recommendations from the BCM Program for additional controls, mitigations, or processes to be implemented to increase resiliency from the most commonly occurring and/or highest impact events.
• Business Impact Analysis (BIA) During this step, the organization identifies the likely and potential impacts from events on the organization or its processes, and the criteria that will be used to quantify and qualify such impacts. The criteria to measure and assess the financial, operational, customer, regulatory and/or reputational impacts must be defined and accepted and then used consistently to define the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for each of the organization’s processes. The result of this analysis is to identify time sensitive processes and the requirements to recover them in an acceptable timeframe.
• Business Continuity Strategies The data that was collected during Risk Evaluation and BIA is used to identify available continuity and recovery strategies for the organization’s operations and technology. Recommended strategies must be approved and funded and must meet both the recovery time (RTO) and recovery point objectives (RPO) identified in the BIA. A cost benefit analysis is performed on the recommended strategies to align the cost of implementing the strategy against the assets at risk.
• Emergency Preparedness and Response Define the requirements to develop and implement the organization’s plan for response to emergency situations that may impact safety of employees, visitors, or other assets. The emergency response plan documents how the organization will respond to emergencies in a coordinated, timely, and effective manner to address life safety and stabilization of emergency situations until the arrival of trained or external first responders.
• Business Continuity Plan Development and Implementation The Business Continuity Plan is a set of documented processes and procedures which will enable the organization to continue or recover time-sensitive processes to the minimum acceptable level within the timeframe acceptable to the organization. In this phase of the Business Continuity Management Program, the relevant teams design, develop, and implement the approved continuity strategies and document the recovery plans to be used in response to an incident or event.
• Awareness and Training Programs A program is developed and implemented to establish and maintain awareness about the Business Continuity Management (BCM) Program and to train the organization’s staff so that they are prepared to respond during an event.
• Business Continuity Plan Exercise, Audit, and Maintenance Establish an exercise, testing, maintenance, and audit program. To continue to be effective, a Business Continuity Management (BCM) Program must implement a regular exercise schedule to establish confidence in a predictable and repeatable performance of recovery activities throughout the organization. As part of the change management program, the tracking and documentation of these activities provides an evaluation of the on-going state of readiness and allows for continuous improvement to recovery capabilities and ensure that plans remain current and relevant. Establishing an audit process will validate the plans are complete and accurate and in compliance with organizational goals and industry standards as appropriate.
• Crisis Communications Define the framework to identify, develop, communicate, and exercise a crisis communications plan to address how communications will be handled by the entity before, during and after an event. The crisis communications plan is developed collaboratively with the organization’s public information and internal information resources where they exist to ensure consistency of communication. The plan will address the need for effective and timely communication between the organization and all the stakeholders impacted by an event or involved during the response and recovery efforts.
• Coordinating with External Agencies Establish policies and procedures to coordinate response, continuity, and recovery activities with external agencies at the local, regional, and, if necessary, national levels while ensuring compliance with applicable statutes and regulations.

Diving into the process of business continuity planning is best guided by experienced professionals who are familiar with the intricacies of these ten steps. There are courses and certifications available through Disaster Recovery Institute International (DRI). Because the initial creation of a BCM program is a one-time thing for most organizations, it can be more cost-effective and a better use of internal resources to work with a third-party. Safety Net provides managed service clients with a “Disaster Recovery Lite” plan. It is a document that contains critical operation details and a plan for getting them back online after an event. More extensive planning is available on a project basis.

There’s no question that 2020 changed the business world forever. While COVID-19 gave us all a taste of the drastic measures required to adjust to an unexpected crisis, many organizations still do not recognize the need for a BCM program. Your services, your products, your colleagues, and your success are valuable and deserve the investment!

Awesome Account Executive

• 24/7 IT Support
• Compliance As A Service
• Proactive Technical Alignment
• Account Management Services
• Co-Managed IT Services
• IT Security
• Cloud & Implementation Services
• Microsoft 365
• Business Continuity & Disaster Recovery
• Microsoft Teams Phone

What Is A Business Continuity Plan? [+ Template & Examples]

Published: December 30, 2022

When a business crisis occurs, the last thing you want to do is panic.

The second-to-last thing you want to do is be unprepared. Crises typically arise without warning. While you shouldn't start every day expecting the worst, you should be relatively prepared for anything to happen.

A business crisis can cost your company a lot of money and ruin your reputation if you don't have a business continuity plan in place. Customers aren't very forgiving, especially when a crisis is influenced by accidents within the company or other preventable mistakes. If you want your company to be able to maintain its business continuity in the face of a crisis, then you'll need to come up with this type of plan to uphold its essential functions.

In this post, we'll explain what a business continuity plan is, give examples of scenarios that would require a business continuity plan, and provide a template that you can use to create a well-rounded program for your business.

Table of Contents:

What is a business continuity plan?

• Business Continuity Types
• Business Continuity vs Disaster Recovery

Business Continuity Plan Template

How to write a business continuity plan.

• Business Continuity Examples

A business continuity plan outlines directions and procedures that your company will follow when faced with a crisis. These plans include business procedures, names of assets and partners, human resource functions, and other helpful information that can help maintain your brand's relationships with relevant stakeholders. The goal of a business continuity plan is to handle anything from minor disruptions to full-blown threats.

For example, one crisis that your business may have to respond to is a severe snowstorm. Your team may be wondering, "If a snowstorm disrupted our supply chain, how would we resume business?" Planning contingencies ahead of time for situations like these can help your business stay afloat when you're faced with an unavoidable crisis.

When you think about business continuity in terms of the essential functions your business requires to operate, you can begin to mitigate and plan for specific risks within those functions.

Crisis Communication and Management Kit

Manage, plan for, and communicate during your corporate crises with these crisis management plan templates.

• Free Crisis Management Plan Template
• 12 Crisis Communication Templates
• Post-Crisis Performance Grading Template
• Additional Crisis Best Management Practices

You're all set!

Click this link to access this resource at any time.

Business Continuity Planning

Business continuity planning is the process of creating a plan to address a crisis. When writing out a business continuity plan, it's important to consider the variety of crises that could potentially affect the company and prepare a resolution for each.

Don't forget to share this post!

Related articles.

How to Navigate Customer Service During a Business Closure

10 Crisis Communication Plan Examples (and How to Write Your Own)

I Tried 7 Crisis Management Software to See if They’re Worth It (Results & Recommendations)

20 Crisis Management Quotes Every PR Team Should Live By

Social Media Crisis Management: Your Complete Guide [Free Template]

De-Escalation Techniques: 19 Best Ways to De-Escalate [Top Tips + Data]

Situational Crisis Communication Theory and How It Helps a Business

What Southwest’s Travel Disruption Taught Us About Customer Service

Showcasing Your Crisis Management Skills on Your Resume

What Is Contingency Planning? [+ Examples]

Manage, plan for, and communicate during a corporate crisis.

Service Hub provides everything you need to delight and retain customers while supporting the success of your whole front office

• Search Search Please fill out this field.
• Business Continuity Plan Basics
• Understanding BCPs
• Benefits of BCPs
• How to Create a BCP
• BCP & Impact Analysis
• BCP vs. Disaster Recovery Plan

Frequently Asked Questions

• Business Continuity Plan FAQs

The Bottom Line

What is a business continuity plan (bcp), and how does it work.

Investopedia / Ryan Oakley

What Is a Business Continuity Plan (BCP)? 

A business continuity plan (BCP) is a system of prevention and recovery from potential threats to a company. The plan ensures that personnel and assets are protected and are able to function quickly in the event of a disaster.

Key Takeaways

• Business continuity plans (BCPs) are prevention and recovery systems for potential threats, such as natural disasters or cyber-attacks.
• BCP is designed to protect personnel and assets and make sure they can function quickly when disaster strikes.
• BCPs should be tested to ensure there are no weaknesses, which can be identified and corrected.

Understanding Business Continuity Plans (BCPs)

BCP involves defining any and all risks that can affect the company's operations, making it an important part of the organization's risk management strategy. Risks may include natural disasters—fire, flood, or weather-related events—and cyber-attacks . Once the risks are identified, the plan should also include:

• Determining how those risks will affect operations
• Implementing safeguards and procedures to mitigate the risks
• Testing procedures to ensure they work
• Reviewing the process to make sure that it is up to date

BCPs are an important part of any business. Threats and disruptions mean a loss of revenue and higher costs, which leads to a drop in profitability. And businesses can't rely on insurance alone because it doesn't cover all the costs and the customers who move to the competition. It is generally conceived in advance and involves input from key stakeholders and personnel.

Business impact analysis, recovery, organization, and training are all steps corporations need to follow when creating a Business Continuity Plan.

Benefits of a Business Continuity Plan

Businesses are prone to a host of disasters that vary in degree from minor to catastrophic. Business continuity planning is typically meant to help a company continue operating in the event of major disasters such as fires. BCPs are different from a disaster recovery plan, which focuses on the recovery of a company's information technology system after a crisis.

Consider a finance company based in a major city. It may put a BCP in place by taking steps including backing up its computer and client files offsite. If something were to happen to the company's corporate office, its satellite offices would still have access to important information.

An important point to note is that BCP may not be as effective if a large portion of the population is affected, as in the case of a disease outbreak. Nonetheless, BCPs can improve risk management—preventing disruptions from spreading. They can also help mitigate downtime of networks or technology, saving the company money.

How To Create a Business Continuity Plan

There are several steps many companies must follow to develop a solid BCP. They include:

• Business Impact Analysis : Here, the business will identify functions and related resources that are time-sensitive. (More on this below.)
• Recovery : In this portion, the business must identify and implement steps to recover critical business functions.
• Organization : A continuity team must be created. This team will devise a plan to manage the disruption.
• Training : The continuity team must be trained and tested. Members of the team should also complete exercises that go over the plan and strategies.

Companies may also find it useful to come up with a checklist that includes key details such as emergency contact information, a list of resources the continuity team may need, where backup data and other required information are housed or stored, and other important personnel.

Along with testing the continuity team, the company should also test the BCP itself. It should be tested several times to ensure it can be applied to many different risk scenarios . This will help identify any weaknesses in the plan which can then be corrected.

In order for a business continuity plan to be successful, all employees—even those who aren't on the continuity team—must be aware of the plan.

Business Continuity Impact Analysis

An important part of developing a BCP is a business continuity impact analysis. It identifies the effects of disruption of business functions and processes. It also uses the information to make decisions about recovery priorities and strategies.

FEMA provides an operational and financial impact worksheet to help run a business continuity analysis. The worksheet should be completed by business function and process managers who are well acquainted with the business. These worksheets will summarize the following:

• The impacts—both financial and operational—that stem from the loss of individual business functions and process
• Identifying when the loss of a function or process would result in the identified business impacts

Completing the analysis can help companies identify and prioritize the processes that have the most impact on the business's financial and operational functions. The point at which they must be recovered is generally known as the “recovery time objective.”

Business Continuity Plan vs. Disaster Recovery Plan

BCPs and disaster recovery plans are similar in nature, the latter focuses on technology and information technology (IT) infrastructure. BCPs are more encompassing—focusing on the entire organization, such as customer service and supply chain. 

BCPs focus on reducing overall costs or losses, while disaster recovery plans look only at technology downtimes and related costs. Disaster recovery plans tend to involve only IT personnel—which create and manage the policy. However, BCPs tend to have more personnel trained on the potential processes. 

Why Is Business Continuity Plan (BCP) Important?

Businesses are prone to a host of disasters that vary in degree from minor to catastrophic and business continuity plans (BCPs) are an important part of any business. BCP is typically meant to help a company continue operating in the event of threats and disruptions. This could result in a loss of revenue and higher costs, which leads to a drop in profitability. And businesses can't rely on insurance alone because it doesn't cover all the costs and the customers who move to the competition.

What Should a Business Continuity Plan (BCP) Include?

Business continuity plans involve identifying any and all risks that can affect the company's operations. The plan should also determine how those risks will affect operations and implement safeguards and procedures to mitigate the risks. There should also be testing procedures to ensure these safeguards and procedures work. Finally, there should be a review process to make sure that the plan is up to date.

What Is Business Continuity Impact Analysis?

An important part of developing a BCP is a business continuity impact analysis which identifies the effects of disruption of business functions and processes. It also uses the information to make decisions about recovery priorities and strategies.

FEMA provides an operational and financial impact worksheet to help run a business continuity analysis.

These worksheets summarize the impacts—both financial and operational—that stem from the loss of individual business functions and processes. They also identify when the loss of a function or process would result in the identified business impacts.

Business continuity plans (BCPs) are created to help speed up the recovery of an organization filling a threat or disaster. The plan puts in place mechanisms and functions to allow personnel and assets to minimize company downtime. BCPs cover all organizational risks should a disaster happen, such as flood or fire.  

Federal Emergency Management Agency. " Business Process Analysis and Business Impact Analysis User Guide ." Pages 15 - 17.

Ready. “ IT Disaster Recovery Plan .”

Federal Emergency Management Agency. " Business Process Analysis and Business Impact Analysis User Guide ." Pages 15-17.

• Terms of Service
• Editorial Policy
• Privacy Policy
• Your Privacy Choices

What is a Business Continuity Plan? 

5 steps to create a robust business continuity plan, 1. build your business continuity management team , 2. conduct risk assessment and business impact analysis, 3. develop and implement recovery strategies , 4. communicate and train, 5. test and upgrade, are you ready to create a solid bcp for your business , how to create a business continuity plan: 5 key steps.

Guest Blogger

Nov, 08, 2022

Reading time

If the recent pandemic has taught us anything, it is that disaster can strike anyone, anytime, and in an absolutely unexpected way. 

Knowing how to create a business continuity plan (BCP) for your business can help you survive through the storm and bounce back successfully. 

💡 Read  Crisis Management 101: How to Save Your Business When a Crisis Strikes

This BCI Horizon Scan Report gives a good overview of the risks businesses are facing presently and the consequences of disruption.

We have seen over and over that small and medium businesses that ignore having a crisis management plan go out of business when disaster strikes. 

On the other hand, according to Agility’s State of Business Continuity report, 80% of businesses surveyed were able to mitigate the pandemic impact because they had a business continuity plan.

Realizing its importance, 91% of businesses have updated their BCP in the past 12 months.

If you are a business owner, you must be convinced by now that BCP is essential for the survival of your business . 

But how do you create a business continuity plan to stay operational when you face a threat? How do you recover fast and with minimal loss?

Here are 5 tested and proven steps you can follow to create a successful business continuity plan. 

Let’s get started. 

Do disasters or threats give advance notice? Most of the time, no.

And even when we get a prior warning, we have very little time to react.

From a business perspective, these are dreadful situations. And that’s where a business continuity plan comes into the picture.

A business continuity plan refers to a detailed outline of procedures and instructions a business will follow to maintain essential functions during a major disruption. It provides a guideline on how to recover faster after a disaster has happened. 

In addition, when crafting a comprehensive business continuity plan, incorporating a legal framework like an LLC becomes pivotal. An LLC not only offers liability protection but also enhances the overall structure of your plan. As you delve into creating a resilient strategy, understanding crucial aspects like ‘ how much does an LLC cost ‘ will contribute to the seamless integration of legal and operational considerations.

Whether you are a large-scale manufacturer or a tech startup developing tools like lead generation software and so on, having a BCP is crucial for your survival.

The disruption could come in any form, a natural calamity, a public health emergency, a technical or mechanical emergency, or a cyber attack. 

Irrespective of the threat, a business continuity plan should essentially cover three major areas. 

• Disaster preparedness 
• Emergency response 
• Recovery plan  

A BCP provides comprehensive protection for your business assets and personnel during and after a disaster strikes. 

Read Four Crisis Management Steps to Take to Stop a Disaster

Realizing how critical a BCP is for your business, you would definitely want to know how to create a business continuity plan to secure your future. 

Here is a 5-step guide on how to create a strong business continuity plan for 2023 and beyond. 

The first step in how to create a good business continuity plan is to make your top management or key stakeholders realize the value of BCP. 

Once they are on board, put together a core BCP management team that will head the entire department. 

The team should consist of:

• Diverse professionals from critical business areas like finance, IT, product development, HR, marketing , communications, and others. Use their data-driven inputs to understand the risks and develop solutions. 
• A dynamic leader who will drive your BCP team. 

Your employees shoul contribute to creating your BCP and also you can get your stakeholders and suppliers involved to ensure critical functions don’t come to a halt. 

Read Crisis Management Plan: How to Keep Your Business Afloat?

The second step in how to create a business continuity plan is analysis.

Risk Assessment (RA) and Business Impact Analysis (BIA) are both essential parts of this phase.

Risk Assessment is all about identifying the internal and external threats to your critical business processes and ranking them based on the severity of the threat.

When carrying out the Risk Assessment, be sure to use the right tools to measure your brand health .

Business Impact Analysis is all about understanding how each of these risks you have identified will impact your business and what should be your recovery approach. 

For successful RA and BIA, your team should identify metrics specific to your business to be measured at different levels. 

To effectively analyze the risks and their impact, follow these methods. 

• Prepare a risk analysis and business impact questionnaire to be filled by different department heads 
• Analyze the responses and draw main observations 
• Identify key resources and establish the dependencies within the organization and outside
• Document and map a detailed plan to mitigate the challenge and recover as successfully as possible

Now we move on to the next step. Based on the above analysis, your core team can create a detailed business continuity plan.  

This is how to create it:

• Prepare a detailed list of procedures and guidelines that your emergency response team should follow. It is good to establish an emergency response team for each critical department right from production, research, HR, security, digital marketing, sales, and finance
• If your facility needs to be shut down for a while due to damage, you should plan for a way to meet the demand for your products or services
• Come up with a remote working policy for your employees in case of a natural disaster or a public health emergency 
• Strategize a data backup and recovery plan in case of a malicious attack
• Invest in good business continuity management tools such as business spending control tools , cloud data backup tools, etc.
• Buy adequate insurance to cover all your critical assets 

We have covered three major steps of how to create a business continuity plan. But this plan can only be executed successfully if your entire team is prepared and equipped to do so. 

Once your business continuity plan is finished, it is important to communicate the same to your employees. This is where an internal communications specialist with a degree in marketing communications would play an important role. They’ll help convey this message well.

They should know everything about the possible risks, the critical functions, and the expected response.

Each team needs to get adequate training on how to execute the business continuity plan for their department. Use premiere pro templates to create engaging training videos, use scenario-based techniques, and apply other effective training methods. 

While you incorporate the BCA into your company policy, it is also necessary to equip your staff with various tools that can help them work efficiently on regular days and when a disaster strikes. 

Along with this, a crisis communication plan should also be set in place to inform your employees, stakeholders, clients, and authorities concerned when a crisis occurs.

Read Crisis Management Plan Examples: The Best & The Worst

Once you have gained in-depth knowledge on how to create a business continuity plan, you’re sure to come up with a solid plan.

But how do you know if it’s effective or not? 

It brings us to the last and equally important step in how to create a good business continuity plan. Test the BCP in all possible ways and validate it. 

The testing should involve all the teams concerned. You should even consider involving key stakeholders, suppliers, and customer care representatives to participate in the testing exercise. 

Once you analyze the results of the exercise, identify the areas you need to improve and upgrade your plan according.

When you send reminder emails to your clients and stakeholders, you can keep them informed about the BCP upgrades too. 

Testing and upgrading is something you need to be doing at regular intervals to ensure your business continuity plan stays relevant and effective. 

It would be safe to conclude that every business should have a strong business continuity plan to safeguard their business from risks of different kinds. 

The BCP for each industry and business type may slightly vary. That’s why your core team should understand how to create a business continuity plan and tailor it for your business. 

If you don’t have a BCP for your business yet, take it up as a priority and create a resilient plan.

Use the above 5 steps as the framework and get started right away. The future of your business depends on it.

Gaurav Sharma is the founder and CEO of Attrock , a results-driven digital marketing company. Grew an agency from 5-figure to 7-figure revenue in just two years | 10X leads | 2.8X conversions |  300K organic monthly traffic. He also contributes to top publications like HuffPost, Adweek, Business 2 Community, TechCrunch, and more.

Hand-picked content. Zero spam policy.

Sign up for our monthly newsletter.

I agree to receive your newsletters and accept the data privacy statement.

An email to confirm your subscription has been sent.

Get in touch

Schedule time with our api experts.

Get detailed information about our API documentation, discuss a personalized solution, and define your next steps.

Join Determ's Talent Network

A newsletter to keep you updated with all things Determ that matter most to you.

Talk with a product expert

Get a personalized product demo - see how Determ works based on your specific needs and goals.

Schedule time with a product expert

Request your brand report.

Tell us more about you and your company. This helps us provide better, more accurate results.

Request your competitor report

Tell us more about you and your competitors. This helps us provide better, more accurate results.

Get started

Let’s set up your personalized Determ experience.

See what Determ can do for you

Schedule a free intro call to discuss your challenges and goals. After that, test Determ for free.

Pick a time and date

By submitting this form I agree to the privacy policy and terms and conditions .

Something went wrong, please try again later.

• Artificial Intelligence
• Generative AI
• Business Operations
• Cloud Computing
• Data Center
• Data Management
• Emerging Technology
• Enterprise Applications
• IT Leadership
• Digital Transformation
• IT Strategy
• IT Management
• Diversity and Inclusion
• IT Operations
• Project Management
• Software Development
• Vendors and Providers
• Enterprise Buyer’s Guides
• United States
• Middle East
• Italia (Italy)
• Netherlands
• United Kingdom
• New Zealand
• Data Analytics & AI
• Newsletters
• Foundry Careers
• Terms of Service
• Privacy Policy
• Cookie Policy
• Copyright Notice
• Member Preferences
• About AdChoices
• Your California Privacy Rights

Our Network

• Computerworld
• Network World

How to create an effective business continuity plan

A business continuity plan outlines procedures and instructions an organization must follow in the face of disaster, whether fire, flood, or cyberattack. here’s how to create a plan that gives your business the best chance of surviving such an event..

The tumultuous events of the past several years have impacted practically every business. And with the number of extreme weather events, cyberattacks, and geopolitical conflicts continuing to rise, business leaders are bracing for the possibility of increasingly more frequent impactful incidents their organizations will need to respond to.

According to PwC’s 2023 Global Crisis and Resilience Survey , 96% of 1,812 business leaders said their organizations had experienced disruption in the past two years and 76% said their most serious disruption had a medium to high impact on operations.

It’s little wonder then that 89% of executives list resilience as one of their most important strategic priorities.

Yet at the same time, only 70% of respondents said they were confident in their organization’s ability to respond to disruptions, with PwC noting that its research shows that too many organizations “are lacking the foundational elements of resilience they need to be successful.”

A solid business continuity plan is one of those foundational elements.

“Every business should have the mindset that they will face a disaster, and every business needs a plan to address the different potential scenarios,” says Goh Ser Yoong, head of compliance at Advance.AI and a member of the Emerging Trends Working Group at the professional governance association ISACA.

A business continuity plan gives the organization the best shot at successfully navigating a disaster by providing ready-made directions on who should do what tasks in what order to keep the business viable.

Without such as a plan, the organization will take longer than necessary to recover from an event or incident — or may never recover at all.

What is a business continuity plan?

A business continuity plan (BCP) is a strategic playbook created to help an organization maintain or quickly resume business functions in the face of disruption, whether that disruption is caused by a natural disaster, civic unrest, cyberattack, or any other threat to business operations.

A business continuity plan outlines the procedures and instructions that the organization must follow during such an event to minimize downtime, covering business processes, assets, human resources, business partners, and more.

A business continuity plan is not the same as a disaster recovery plan , which focuses on restoring IT infrastructure and operations after a crisis. Still, a disaster recovery plan is part of the overall strategy to ensure business continuity, and the business continuity plan should inform the action items detailed in an organization’s disaster recovery plan. The two are tightly coupled, which is why they often are considered together and abbreviated as BCDR.

Why business continuity planning matters

Whether you operate a small business or a large corporation, it’s vital to retain and increase your customer base. There’s no better test of your capability to do so than right after an adverse event.

Because restoring IT is critical for most companies, numerous disaster recovery solutions are available. You can rely on IT to implement those solutions. But what about the rest of your business functions? Your company’s future depends on your people and processes. Being able to handle any incident effectively can have a positive effect on your company’s reputation and market value, and it can increase customer confidence.

Moreover, there are increasing consumer and regulatory expectations for both enterprise security and continuity today. Consequently, organizations must prioritize continuity planning to prevent not only business losses, but financial, legal, reputational, and regulatory consequences.

For example, the risk of having an organization’s “license to operate” withdrawn by a regulator or having conditions applied (retrospectively or prospectively) can adversely affect market value and consumer confidence.

Building (and updating) a business continuity plan

Whether building the organization’s first business continuity plan or updating an existing one, the process involves multiple essential steps.

Assess business processes for criticality and vulnerability: Business continuity planning “starts with understanding what’s most important to the business,” says Joe Nocera, principle in the cyber risk and regulatory practice at PwC, a professional services firm.

So the first step in building your business continuity plan is assessing your business processes to determine which are the most critical; which are the most vulnerable and to what type of events; and what are the potential losses if those processes go down for a day, a few days, or a week.

“This step essentially determines what you are trying to protect and what you are trying to keep up for systems,” says Todd Renner, senior managing director in the cybersecurity practice at FTI Consulting.

This assessment is more demanding than ever before because of the complexity of today’s hybrid workplace, the modern IT environment, and the reliance on business partners and third-party providers to perform or support critical processes.

Given that complexity, Goh says a thorough assessment requires an inventory of not only key processes but also the supporting components — including the IT systems, networks, people, and outside vendors — as well as the risks to those components.

This is essentially a business impact analysis.

Determine your organization’s RTO and RPO: The next step in building a business continuity plan is determining the organization’s recovery time objective (RTO), which is the target amount of time between point of failure and the resumption of operations, and the recovery point objective (RPO), which is the maximum amount of data loss an organization can withstand.

Each organization has its own RTO and RPO based on the nature of its business, industry, regulatory requirements, and other operational factors. Moreover, different parts of a business can have different RTOs and RPOs, which executives need to establish, Nocera says.

“When you meet with individual aspects of the business, everyone says everything [they do] is important; no one wants to say their part of the business is less critical, but in reality you have to have those challenging conversations and determinations about what is actually critical to the business and to business continuity,” he adds.

Detail the steps, roles, and responsibilities for continuity: Once that is done, business leaders should use the RTO and the RPO, along with the business impact analysis, to determine the specific tasks that need to happen, by whom, and in what order to ensure business continuity.

“It’s taking the key components of your analysis and designing a plan that outlines roles and responsibilities, about who does what. It gets into the nitty-gritty on how you’re going to keep the company up and running,” Renner explains.

One common business continuity planning tool is a checklist that includes supplies and equipment, the location of data backups and backup sites, where the plan is available and who should have it, and contact information for emergency responders, key personnel, and backup site providers.

Although the list of possible scenarios that could impact business operations can seem extensive, Goh says business leaders don’t have to compile an exhaustive list of potential incidents. Rather, they should compile a list that includes likely incidents as well as representative ones so that they can create responses that have a higher likelihood of ensuring continuity even when faced with an unimagined disaster.

“So even if it’s an unexpected event, they can pull those building blocks from the plan and apply them to the unique crisis they’re facing,” Nocera says.

The importance of testing the business continuity plan

Devising a business continuity plan is not enough to ensure preparedness; testing and practicing are other critical components.

Renner says testing and practicing offer a few important benefits.

First, they show whether or how well a plan will work.

Testing and practicing help prepare all stakeholders for an actual incident, helping them build the muscle memory needed to respond as quickly and as confidently as possible during a crisis.

They also help identify gaps in the devised plan. As Renner says: “Every tabletop exercise that I’ve ever done has been an eye-opener for everyone involved.”

Additionally, they help identify where there may be misalignment of objectives. For example, executives may have deprioritized the importance of restoring certain IT systems only to realize during a drill that those are essential for supporting critical processes.

Types and timing of tests

Many organizations test a business continuity plan two to four times a year. Experts say the frequency of tests, as well as reviews and updates, depends on the organization itself — its industry, its speed of innovation and transformation, the amount of turnover of key personnel, the number of business processes, and so on.

Common tests include tabletop exercises , structured walk-throughs, and simulations. Test teams are usually composed of the recovery coordinator and members from each functional unit.

A tabletop exercise usually occurs in a conference room with the team poring over the plan, looking for gaps and ensuring that all business units are represented therein.

In a structured walk-through, each team member walks through his or her components of the plan in detail to identify weaknesses. Often, the team works through the test with a specific disaster in mind. Some organizations incorporate drills and disaster role-playing into the structured walk-through. Any weaknesses should be corrected and an updated plan distributed to all pertinent staff.

Some experts also advise a full emergency evacuation drill at least once a year.

Meanwhile, disaster simulation testing — which can be quite involved — should still be performed annually. For this test, create an environment that simulates an actual disaster, with all the equipment, supplies and personnel (including business partners and vendors) who would be needed. The purpose of a simulation is to determine whether the organization and its staff can carry out critical business functions during an actual event.

During each phase of business continuity plan testing, include some new employees on the test team. “Fresh eyes” might detect gaps or lapses of information that experienced team members could overlook.

Reviewing and updating the business continuity plan should likewise happen on an ongoing basis.

“It should be a living document. It shouldn’t be shelved. It shouldn’t be just a check-the-box exercise,” Renner says.

Otherwise, plans go stale and are of no use when needed.

Bring key personnel together at least annually to review the plan and discuss any areas that must be modified.

Prior to the review, solicit feedback from staff to incorporate into the plan. Ask all departments or business units to review the plan, including branch locations or other remote units.

Furthermore, a strong business continuity function calls for reviewing the organization’s response in the event of an actual event. This allows executives and their teams to identify what the organization did well and where it needs to improve.

How to ensure business continuity plan support, awareness

One way to ensure your plan is not successful is to adopt a casual attitude toward its importance. Every business continuity plan must be supported from the top down. That means senior management must be represented when creating and updating the plan; no one can delegate that responsibility to subordinates. In addition, the plan is likely to remain fresh and viable if senior management makes it a priority by dedicating time for adequate review and testing.

Management is also key to promoting user awareness. If employees don’t know about the plan, how will they be able to react appropriately when every minute counts?

Although plan distribution and training can be conducted by business unit managers or HR staff, have someone from the top kick off training and punctuate its significance. It’ll have a greater impact on all employees, giving the plan more credibility and urgency.

Related content

An intro to innovation in the u.s. government, ai at the retail edge: what’s new, and what’s coming soon, how technology is shaping education in saudi arabia, oracle makes its pitch for the enterprise cloud. should cios listen, from our editors straight to your inbox, show me more, black cios on the path to it leadership.

Regulation remains the strongest multiplier to cybersecurity growth

An Intelligent Future for Manufacturing

CIO Leadership Live Australia with Scott Andrews, Chief Operating Officer, Idea Science

Eaton CIO Katrina Redmond on optimizing AI and digital services

Tech layoffs continue, while AI prevents them from getting new jobs quickly

3 Leadership Tips: Giovanni Pizzoferrato, CTO, Kinaxis

3 Leadership Tips: Adam Ennamli, Chief Risk Officer, General Bank of Canada

An official website of the United States government

Here’s how you know

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Business Continuity Planning

Organize a business continuity team and compile a  business continuity plan  to manage a business disruption. Learn more about how to put together and test a business continuity plan with the videos below.

Business Continuity Plan Supporting Resources

• Business Continuity Plan Situation Manual
• Business Continuity Plan Test Exercise Planner Instructions
• Business Continuity Plan Test Facilitator and Evaluator Handbook

Business Continuity Training Videos

The Business Continuity Planning Suite is no longer supported or available for download.

Business Continuity Training Introduction

An overview of the concepts detailed within this training. Also, included is a humorous, short video that introduces viewers to the concept of business continuity planning and highlights the benefits of having a plan. Two men in an elevator experience a spectrum of disasters from a loss of power, to rain, fire, and a human threat. One man is prepared for each disaster and the other is not.

View on YouTube

Business Continuity Training Part 1: What is Business Continuity Planning?

An explanation of what business continuity planning means and what it entails to create a business continuity plan. This segment also incorporates an interview with a company that has successfully implemented a business continuity plan and includes a discussion about what business continuity planning means to them.

Business Continuity Training Part 2: Why is Business Continuity Planning Important?

An examination of the value a business continuity plan can bring to an organization. This segment also incorporates an interview with a company that has successfully implemented a business continuity plan and includes a discussion about how business continuity planning has been valuable to them.

Business Continuity Training Part 3: What's the Business Continuity Planning Process?

An overview of the business continuity planning process. This segment also incorporates an interview with a company about its process of successfully implementing a business continuity plan.

Business Continuity Training Part 3: Planning Process Step 1

The first of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “prepare” to create a business continuity plan.

Business Continuity Training Part 3: Planning Process Step 2

The second of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “define” their business continuity plan objectives.

Business Continuity Training Part 3: Planning Process Step 3

The third of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “identify” and prioritize potential risks and impacts.

Business Continuity Training Part 3: Planning Process Step 4

The fourth of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “develop” business continuity strategies.

Business Continuity Training Part 3: Planning Process Step 5

The fifth of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should define their “teams” and tasks.

Business Continuity Training Part 3: Planning Process Step 6

The sixth of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “test” their business continuity plans. View on YouTube

Last Updated: 12/21/2023

Return to top

An official website of the United States government

Here’s how you know

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

https://www.nist.gov/mep/business-continuity-planning

Manufacturing Extension Partnership (MEP)

Business continuity planning.

Business continuity planning enables you to create an easy-to-use, actionable business continuity planning solution to prepare for the impact of a broad range of threats including natural disasters, disease outbreaks, accidents and terrorism. In addition business continuity planning can help when you face technology-related hazards like the failure of systems, equipment or software. MEP Centers can assist you in developing a plan unique to your needs.

If your company needs to create or tweak a business continuity plan, I highly suggest reaching out to Purdue MEP!

—Doug Ellington, Director of Finance, Estes Design and Manufacturing Read the Success Story

Illuminating Possibilities to Achieve ISO Certification

Business Continuity Plans: Lessons Learned From Puerto Rico

For more information or assistance with business continuity planning, please contact your local MEP Center .

If you would like someone to contact you about business continuity planning , please complete the form below.

For General Information

• MEP Headquarters [email protected] (301) 975-5020 100 Bureau Drive, M/S 4800 Gaithersburg, MD 20899-4800

• Skip to right header navigation
• Skip to main content
• Skip to secondary navigation
• Skip to footer

Business Continuity and Crisis Management Consultants

Starting a Business Continuity Program

April 26, 2022 By //  by  Bryan Strawser

“Good is the enemy of great. And that is one of the key reasons why we have so little that becomes great.” -Jim Collins

In his book, aptly named “Good to Great,” Collins uses this principle to explain why so many, from schools, government, and businesses, to individual people—squander their potential and stay stuck in mediocrity.

I know this is equally true for a lot of business continuity professionals and their programs.

While I’m not advocating that every business continuity program should strive for greatness (although maybe in my business continuity nerd way I secretly am), I cringe to see so many be content with their rigid and outdated spreadsheets and Word docs approach to business continuity when with a little bit of effort, the right plan, and the right help, they can do so much more.

Still, whatever it is—moving from the L.A. burbs to small-town Tennessee, doing date night at the Thai Table instead of Jolene’s Cafe, or God forbid swapping your Levi’s 505s for 501s—change is scary and in the beginning, often hard.

We also know that this is equally true when standing up or modernizing your organization’s business continuity program.  So our aim here is to take some of that scare factor away.

Here, we talk about the key elements of a strong business continuity program, what it takes to get started, and how we work with our clients to ensure long-term business continuity program success.

What’s a business continuity program and why do I need one?

Business continuity is a rapidly evolving discipline, so there’s understandably still a lot of confusion about what a business continuity program really encompasses. Google “what is a business continuity program” and you’ll see what I mean.

Sometimes the best way to understand something is by understanding what it’s not.

And a business continuity program is not:

• A business continuity plan (standing alone)
• An IT disaster recovery plan
• A software subscription
• An insurance policy from your insurer
• Filling out a template and checklist and putting your staff through a one-hour click-it and forget-about-it web-based training module

While these are all important pieces of a business continuity program (although arguably not insert-fork-in-eyes web training), they are not in themselves a comprehensive and effective business continuity program.

So then, what exactly is a business continuity program and what does it take to make sure your’s gets the job done?

Most simply, we think of business continuity planning as the discipline of making your organization more resilient, or able to solve big problems.

A business continuity program is the means by which you embed this discipline into your organization to build your capacity to prevent, withstand, and recover from unplanned disasters and adverse events. In the face of disruption, it ensures that you can continue operations and protect your most important assets, especially your people.

In today’s world—hello climate change, pandemics, and cybercrime—having a good business continuity program is all but negotiable. Here are the key components that yours should include.

Want to learn more about Business Continuity?

Our Ultimate Guide to Business Continuity contains everything you need to know about business continuity.

You’ll learn what it is, why it’s important to your organization, how to develop a business continuity program, how to establish roles & responsibilities for your program, how to get buy-in from your executives, how to execute your Business Impact Analysis (BIA) and Business Continuity Plans, and how to integrate with your  Crisis Management  strategy.

We’ll also provide some perspectives on how to get help with your program and where to go to learn more about Business Continuity.

Read our Ultimate Guide to Business Continuity

The 3 Core Components of a Good Business Continuity Program

A thorough and effective business continuity program should include three core components— emergency procedures , a crisis framework , and business continuity plans .

Let’s take each in turn.

Emergency Procedures

If a tornado churns through your city or a disgruntled employee launches an assault at your workplace, will your people know what to do?

Whether it’s calling 911, taking evasive measures, or reporting to a safe rally point, your emergency procedures make sure that your people know exactly what to do in the face of a crisis.

Your emergency procedures should include a clear actionable checklist of steps to follow, including contacting emergency services, taking immediate steps to minimize the threat and protect human life, and who to contact within your organization to escalate the incident.

While each checklist is built on the same foundation, some of the steps on your checklists will vary depending on the type of emergency you are responding to. Ideally, you should have emergency procedures designed for each of your locations, events, and meetings, in addition to specific checklists for each type of potential situation, like an active shooter, bloodborne pathogens, fire, fatality, etc.

Even the most excellent emergency procedure is useless if your people don’t know about it or where to find it. After creating emergency procedures for each applicable scenario, you should make sure that each is labeled, organized, and stored in an easy-access location of which all employees are made aware. While a binder of laminated checklists can suffice, we like to provide our clients with a custom pocket guide app available on iOS and Android to ensure that all their employees have quick access to their emergency procedures.

Crisis Management Framework

Aside from not really having a plan, one of the biggest problems we see in crisis management is having too many plans. When companies don’t have a coordinated approach, various organizational components develop their own to fill the void. But taking a siloed approach to crisis management often leads to confusion, frustration, and a less than effective crisis response.

That’s why every organization should have a flexible crisis management framework that provides a unified approach to incident escalation, communication, and decision making.  Once an all-hazards crisis management framework is put into place, specific annexes (plans) can be developed that address known risk/threat scenarios specific to your organization, such as active shooter, data breach, or major hurricane.

About Bryan Strawser

Bryan Strawser is Founder, Principal, and Chief Executive at Bryghtpath LLC, a strategic advisory firm he founded in 2014. He has more than twenty-five years of experience in the areas of, business continuity, disaster recovery, crisis management, enterprise risk, intelligence, and crisis communications.

At Bryghtpath, Bryan leads a team of experts that offer strategic counsel and support to the world’s leading brands, public sector agencies, and nonprofit organizations to strategically navigate uncertainty and disruption.

Learn more about Bryan at this link .

PO Box 131416 Saint Paul, MN 55113 USA

[email protected]

Our Capabilities

• Active Shooter Programs
• Business Continuity as a Service (BCaaS)
• IT Disaster Recovery Consulting
• Resiliency Diagnosis®️
• Crisis Communications
• Global Security Operations Center (GSOC)
• Emergency Planning & Exercises
• Intelligence & Global Security Consulting
• Workplace Violence & Threat Management

Our Free Courses

Active Shooter 101

Business Continuity 101

Crisis Communications 101

Crisis Management 101

Workplace Violence 101

Our Premium Courses

5-Day Business Continuity Accelerator

Communicating in the Critical Moment

Crisis Management Academy®️

Managing Threats Workshop

Preparing for Careers in Resilience

Our Products

After-Action Templates

Business Continuity Plan Templates

Communications & Awareness Collateral Packages

Crisis Plan Templates

Crisis Playbook®

Disaster Recovery Templates

Exercise in a Box®

Exercise in a Day®

Maturity Models

Ready-Made Crisis Plans

Resilience Job Descriptions

Pre-made Processes & Templates

• Higher Education
• Government, Healthcare & NGOs
• Manufacturing
• CPG & Retail

• Technology Partners

• Leadership Team
• Our Purpose
• Strategy & Consulting
• Business Transformation
• Finance Transformation
• Shared Services and GBS
• Operating Models
• Business Process Management
• Finance & Accounts Outsourcing
• Outsourced Recruitment Services
• Accounting Services for Accountants
• Process Management Services
• Human Resources Outsourcing
• Marketing Services
• IT Support Services
• Digital & Automation
• Intelligent Automation
• Robotic Process Automation
• Advanced Analytics
• Software Services
• Accounting & Audit Firms
• Student Accommodation
• Build-to-Rent
• Wine and Spirits
• Recruitment
• Case Studies
• Customer Testimonials

5 Steps to Develop A Robust Business Continuity Plan

INTRODUCTION – BUSINESS CONTINUITY PLAN

The Covid-19 pandemic has required many businesses to blow the dust off their business continuity plans and has exposed them to the reality of needing to support ongoing operations while reacting to a crisis in real-time.

While there are many conflicting statistics about if and how long a business can stay afloat after it has experienced a disaster, one thing is certain, we are witnessing an increasing number of incidents from natural disasters, accidents, sabotage, power and energy disruptions, environmental disasters and cyber-attacks. The current Covid-19 pandemic is, of course, a dramatic and worldwide example of this.

Is your business prepared to weather a significant disruption that threatens your ability to continue? How will your recovery plan shape up as we emerge from the other side of the Covid-19 crisis? Do you have a plan that will enable your organization’s critical services or products to be continually delivered to clients? If not, it is time to assess/build your business lifesaver.

The diagram below shows 5 key steps to developing and refreshing a business continuity plan.

Step 1: Analysis

The first step in creating your plan is completing an as-is analysis to identify the critical activities in your organization. In addition to identifying the activities that must continue, the harder task can be achieving agreement with your stakeholders and clients on what activities have to be maintained at peak performance and service levels, what activities and services will need to stop (even if only temporarily), and what activities and services will be provided at a lower level. Once you know what is most important, prioritize the activities for continuous delivery versus recovery, estimate the time required to recover and the issues that are unique to your organization or that are highly complex.

The financial impact should not be overlooked: how long can your business operate without key revenue generating products or services while incurring costs to recover? Covid-19 has generally seen businesses be flexible with “client-friendly” cancellation policies and moratoriums on payment demands. But then, as a direct consequence, many businesses are not only losing customers and sales, they are also having to refund deposits, provide incentives to keep existing customers, and incur costs to support new ways of operating. All this is resulting in the bleeding of cash.

Step 2: Risk Assessment

Here you need to consider internal and external threats to your critical business activities and operations. And of course a robust BCP needs to consider all potential threats and scenarios. Depending on your location, the risks for certain types of threats may be greater than others. For example, if you are located on the East Coast of North America, the threat of a hurricane is higher; if you are on the West Coast along the entire American continent, or a location along many other fault lines across the world, the threat from earthquakes and tsunamis is much higher. Where electricity supplies are less robust, the threat of power outages and extended power outages will be a greater concern. Then there are many risks that you would want to consider regardless of your location and for which you will need to make sure your plan has specific procedures, pandemics being a current example, but fire and flood are common risk examples as well. You will also want to assess how tolerant management and clients are to operating at a reduced or minimum capacity and for how long. Risk assessment is about understanding your organization’s vulnerabilities and identifying ways to avoid, reduce, or mitigate the risks associated with them.

Step 3: Develop Recovery Procedures

Preparing for step three in the plan involves outlining how you will respond to an incident once it happens. It is the very detailed, step by step tasks and procedures that need to be taken to meet the challenges and reduce the risk to your organization’s people, operations and assets. You may identify the need to change your operating model to make it more resilient by implementing virtual work models, retaining redundant capacity/multiple sites, and/or establishing a hybrid workforce of human and digital workers. For example, many organizations have implemented remote working as a key and immediate strategy to achieve social distancing during the Covid-19 crisis, and several of these may retain some degree of remote working in their “new normal” to strengthen their ability to react to the next business disruption event. Others are working to integrate Intelligent Automation (such as Robotic Process Automation, Machine Learning, Chatbots, National Language Processing, Artificial Intelligence and Blockchain), into their processes to provide scalable capacity, improve productivity, and strengthen resilience.

Once you have your risks identified and understand your operating model, you then need to prepare your response. In this step of the cycle, you want to organize recovery teams, determine task recovery procedures, and develop work site and technology recovery plans. Additionally, you will need to consider the impact on personnel. First and foremost, their immediate safety, but after the dust has settled, they will want to contact loved ones or need transportation home. This can be challenging if they have lost their personal items such as keys, phones and their wallets. In the days and weeks to follow, having counseling available for them and their immediate families will go a long way in helping them feel they are a valued part of your organization. It is also useful to develop a detailed communications and an external public relations plan. How your organization handles the media can prevent negativity and can help you maintain some level of control over what the community, your staff and investors are hearing and believing.

Step 4: Communicate & Integrate

A plan is only useful if people know about it. Once you have developed your plan, you need to communicate it to your staff and integrate it into your company’s policies and culture so that everyone knows where to find it, what it contains, and how to use it. It should be designed for stressful and confusing situations; therefore, it needs to use simple terminology. Hard copies and electronic format should be easily accessible (on and off-site) and, contingent on resources available, a web portal is a great tool to maintain versions and increase access. Other groups that you will need to communicate with include your neighbors, community, customers, suppliers, and banks. Having pre-prepared messages will decrease the time it takes to communicate with these key groups when an incident does occur.

Step 5: Test, Train & Maintain

The only way to know if your plan will work is by testing it. Your staff needs to know what to do, where to go and how to work together. Running test exercises increase survival likelihood and minimizes impact, they can also enhance public image. To train your teams, familiarize your staff and test your plan, there are three different types of exercises that can be performed: seminar, table-top and live. Below is a diagram outlining their major characteristics:

Even a table-top exercise that is scheduled in advance can be made more realistic and effective with a few simple changes:

• Announce at the start of the exercise that the senior leader was called away at the beginning of the crisis (perhaps to represent the organization at a regional response team), so several individuals in the room need to take on new roles.
• Invite external stakeholders, key suppliers and clients to join the exercise and represent their organization; if this is not possible, assign these roles to actual people to role play.
• “Deadline Diana” who is working on a very important task that she is committed to completing within the next hour. Diana reacts to the situation as if nothing is happening.
• “Laughing Larry” is trying to lighten the seriousness of the situation and is using humor inappropriately to distract participants.

Whether it is after a training exercise or a real event you have experienced, it is crucial that you update your plans and procedures to make sure you address any weaknesses in the plan. What would you do differently to better protect your business? It is important to review your plan on a regular basis to ensure that details remain current. Updating the response team members’ full contact information is a good example of information that can quickly become outdated.

Business Continuity Plan should be a consideration at all levels of the organization, from strategic planning all the way down to your daily operations. At Chazey Partners, we believe successful recovery from a crisis event depends on your people and your readiness – not on your organization’s size, infrastructure, equipment, or technologies. Our structured Business Continuity Plan approach provides pragmatic recommendations for your current BCP strategy, and also offers integrated solutions to develop a BCP program suitable to your organization’s unique needs and circumstances.

5-Steps-to-Develop-a-Business-Continuity-Plan

Check out our BCP Webinar – Making Your Business Continuity Plan Real

• Innovation in Orange County
• Innovation Community
• Accelerator
• UCI Research Park
• Service Providers
• Student Voices
• High School Students
• College Students
• Professionals

The Ultimate Guide to Creating an Effective Business Continuity Plan (BCP)

• Resource Home

This article provides a comprehensive guide on what it takes to create a BCP.

Running a business is difficult at the best of times. Attempting to increase your market share while also providing customers with what they want is a tricky balance that requires determination, perseverance, and a small amount of luck. No matter how well you run your business, there are inevitably going to be times when you are required to handle unforeseen circumstances . In the event of a national disaster or emergency, it's important that you're prepared for how this emergency will adversely affect your business.

If you want to be wholly prepared for a national disaster or emergency, it's recommended that you create a business continuity plan, which is a detailed outline of various procedures that your business would use to maintain productivity, prevent further damage, and eventually recover if ever a national disaster or emergency occurs.

While creating this type of plan can take some time, doing so can help you stay afloat and eventually rebound in such a scenario. If a national emergency causes a serious disruption with the operations of your business, you will almost certainly lose some revenues. However, having a business continuity plan in place should allow you to mitigate your losses.

What is Business Continuity?

Business continuity   is the act of maintaining your business functions in the event of a national emergency or disaster. There are times when it won't be possible to maintain business functions. In this case, business continuity involves rapidly resuming functions after the initial disruption. The disruption that could require business continuity could be anything from a malicious cyber attack to a flood.

A business continuity plan is a kind of outline of procedures that your business would take if a national disaster or emergency occurred. The goal of these procedures would be to protect business assets, business partners, human resources, and business processes. Without having a plan in place, you could be forced to let go of a sizable percentage of your employees or shut down your business altogether. A business continuity plan should also help you avoid panic when an emergency happens, which could be enough to minimize your losses.

An effective business continuity plan is useful in many different cases of:

• Global pandemics
• Natural disasters
• Man-made disasters
• Utility failures
• Intentional sabotage
• Cybersecurity attacks

Disaster Recovery Plan Vs. Business Continuity Plan Vs. Business Impact Analysis

There are three types of plans that have somewhat similar meanings but are used in different situations. Understanding what each of these plans are used for should help you determine which plan to create in the event of an emergency.

A disaster recovery plan is almost the same as a business continuity plan with the main difference being that a disaster recovery plan focuses on restoring IT operations and infrastructure following a disaster. In fact, you could create a disaster recovery plan as a part of your business continuity plan.

As touched upon previously, a business continuity plan is designed to help you maintain all business processes when an emergency occurs, which include IT operations.

A business impact analysis can also be a component of your business continuity plan. This analysis is designed to help you determine how your business was impacted by a sudden disruption to your operations.

The analysis will typically provide you with the cost of the disruption. If the impact is significant, an analysis can push you towards outsourcing some of your operations for the time-being that are deemed to be non-essential, which will allow you and your employees to work solely on resuming the most important functions of your company.

Now that you understand the difference between these three plans, you should be able to determine which plans to use when an emergency occurs.

Creating an Effective Business Continuity Plan

The location, type, and size of your company will dictate how long it takes for you to create an effective business continuity plan. While it's possible for some smaller businesses and startups to create one of these plans in as little as one week, other businesses can take upwards of two months to complete the plan.

The process is an extensive one that begins with you identifying the objectives of your plan and ends with you developing a training curriculum that your team and employees can be tested on before an emergency occurs.

To get started with creating a business continuity plan, it's first important that you understand what each step in this plan entails.

Identify the objectives of the plan and set goals

Identify key business areas & critical functions

Conduct a Business Impact Analysis (BIA)

Create a plan to maintain operations during emergencies

Develop a testing and training curriculum

1. Identify the Objectives of the Plan and Set Goals

First, you should identify the objectives of your business continuity plan, after which you can set goals around these objectives. Determine how detailed you want the plan to be and how often you would like your employees to practice the plan. Keep in mind that it's not enough to create a business continuity plan. In order for the plan to be effective when a national emergency occurs, your employees will need to be familiar with how to implement the plan.

You can also identify what the outcomes are for a successful plan and which milestones you should track while your business operations are being disrupted. It's important that you make a budget for your business continuity plan, which should take research hours, training time, and preparation into account. The goals that you set can depend on the severity of the emergency or disaster. In general, you should focus on minimizing losses in regards to revenues and employees. Make sure that you have a team that can organize everything when it comes time to implement the plan.

2. Identify Key Business Areas & Critical Functions

When your business operations are disrupted by a national disaster or emergency, you may be unable to keep all of your business functions running smoothly, which is why it's highly recommended that you focus primarily on your key business areas and critical functions. As such, it's important that you identify what these functions and business areas are. The best way to determine which areas of your business are most important is by looking at the functions that hurt your company the most if they weren't running properly. This damage could be in the form of revenue loss or harm to your reputation.

Make sure that you take look at all of the functions of your business so that you can classify these functions as low, medium, or high. The functions that would highly damage your company if they weren't around are the ones that your business continuity plan should be centered around. You should also look into what it takes to move some of these functions offsite. If your employees were able to work from home, you may be able to preserve some of the more critical functions without too much loss of revenue.

3. Conduct a Business Impact Analysis (BIA)

A business impact analysis is designed to determine what kind of an impact interruptions to your business would have in the event of an emergency or disaster. This is a kind of forecast that would allow you to keep important departments in your company afloat during an emergency.

The BIA that you create should include scenarios for every kind of disaster as well as the severity of each disaster. Once the disaster or emergency occurs, you should be able to immediately identify what your next course of action would be based on the business impact analysis that you've conducted.

4. Create a Plan to Maintain Operations During Emergencies

The most important component of your business continuity plan involves creating a plan that will allow you to maintain operations during an emergency. Full readiness for an emergency should include prevention strategies, response strategies, and recovery strategies. You and your employees should know exactly which steps to take throughout every phase of a disaster.

Prevention strategies focus on preventive measures you can take before the emergency occurs. For instance, having a remote working solution in place before the emergency happens will allow you to mitigate the damage. Every department should provide you with a response strategy, which involves the things that you should do when the emergency is ongoing.

Along with evacuation and safety protocols, it's also important that you know what to communicate to your customers if ever an emergency occurs that would result in extended downtime. Finally, a recovery strategy is centered around making your company fully operational once the event has been wholly contained. Make sure that you map out a timeline that tells you how long it will take to get up and running.

5. Develop a Testing and Training Curriculum

In order for a business continuity plan to be effective, your employees and department heads should know how to implement the plan through each phase of prevention, response, and recovery. Having testing and training curriculum in place is important to make sure that none of your employees panic, which would only serve to worsen the situation.

For instance, the training that you provide to your employees should make sure to note that no employee should publish rumors or unconfirmed information about a disaster on social media . If the rumor ends up being incorrect, your company's reputation would take a hit.

The exercises that should be included in training extend to:

• Clear goals and objectives
• Easily understood scenarios
• Clear instructions on what to do for every participant of the training
• A wholly realized narrative
• An evaluation once the exercise has been completed

Why Business Continuity Planning Matters

Business continuity planning is essential if you want your company to remain afloat in the event of a disaster or emergency that causes disruption to your core business functions. These plans are particularly beneficial for your startup to have if you want to mitigate your losses and make sure that your startup continues to grow once the event has concluded. If you don't have a plan in place, panic can set in among your employees, which could lead to small mistakes that create larger issues when you should be making sure that your critical functions continue to run.

While it can take anywhere from a couple of weeks to several months to complete a comprehensive business continuity plan, the long-term benefits of creating a plan can't be stated enough. To get started with creating a business continuity plan, your first step should be to identify the objectives of your plan and what the goals of these objectives should be. Afterwards, make sure that you ascertain which business functions are most important to your bottom line. If you take these steps now, you should be able to continue to function in the event of an emergency.

Revised 11/28/2020

FREE RESOURCE

The ultimate guide to wet lab incubators.

Download The Ultimate Guide to Wet Lab Incubators in Southern California, a handbook to assist life science start-ups through the entire decision-making process to find wet lab space.

Fill out the form below to download the Ultimate Guide

Related articles.

• Strategic Negotiation Basics You Need to Know
• How to Create a Business Plan
• 9 Strategies for Winning Grants at the NIH and Beyond
• DoD Funding Strategies: Understanding the DoD Perspective
• Implementing Voice of Customer (VOC) in Your Business

Apply for residency today

Do you have a great company in the bioscience or medtech industry? Do you need wet-lab and/or fabrication space to develop and test your product?

Related Articles

01/22/2024 | 4 MIN READ

The pros and cons of joining a life science startup.

01/09/2024 | 7 MIN READ

The booming industry of bioscience.

01/04/2024 | 8 MIN READ

Things to consider when working with an irb.

How-To: Effectively Scope Your Business Continuity Program

Early on in the development of a business continuity program, careful, pragmatic scoping can be the difference between quick and appropriate wins and a never-ending planning effort with little capability.  Organizations typically build programs due to customer and/or regulatory requirements; however, instead of taking the time to carefully scope and prioritize the business continuity effort (and provide resources accordingly), organizations often take an “all or nothing” approach to planning – plan for every “box on the org chart”, every facility, every application, and every resource.  Many organizations do not realize that business continuity can, and often should, initially address an organization’s most critical/time-sensitive products and services, expanding to other parts of the organization overtime.

An appropriate scope enables an organization to efficiently plan for a disruptive incident.  Additionally, scoping effectively allows an organization to prioritize critical products and services during the initial implementation of business continuity and expand the program to less critical areas overtime.  Ideally, an organization defines the scope of business continuity based on the following factors, which are discussed in additional detail throughout the remainder of this post:

• Stakeholder Requirements
• Products and Services
• Risk Appetite

Understand Requirements Most importantly, an effectively scoped business continuity program takes into account stakeholder requirements.  Stakeholders include customers, regulators, management, and other interested parties.  Each stakeholder group has expectations, and to be effective, business continuity should address and protect an organization from violating these expectations.  Therefore, an organization should design its business continuity program to protect itself from the impacts of violating key requirements such as:

• Contractual Obligations (service level agreements)
• Regulatory Requirements
• Customer Promises
• Employee Commitments
• Health/Safety Requirements

While requirements vary greatly based on a number of factors, an organization will find it extremely difficult to prioritize, let alone build and maintain an effective business continuity program, without understanding its requirements.  Furthermore, once requirements are understood, an organization can document a specific and appropriate set of business continuity objectives.

Define Products and Services After understanding its obligations and establishing business continuity objectives, an organization can move forward with the scoping effort by understanding and assessing its products and services (beneficial outcomes provided by an organization to its customers, recipients and interested parties – ISO 22301) delivered to each relevant stakeholder group.   Defining products and services is an effective way to manage the scoping effort at a strategic level because products and services are easily understood by management, employees, regulators, and customers alike.  They create value!  After an organization takes an inventory of its products and services, it must determine if an interruption to each product and service would result in the inability to comply with the organization’s requirements and/or business continuity objectives (as described above), or result in unacceptable consequences.  Those products and services, that if interrupted would result in missed obligations or unacceptable consequences, should be considered in scope, together with all supporting departments, activities, and resources.

Once the organization defines a list of “in-scope” products and services, it can and should retrieve the organizational chart and begin mapping departments or business units back to these products and services (remembering that every department will not be included).  This exercise allows an organization to begin understanding and prioritizing the critical business areas that must be addressed by business continuity and also provides insight into the time and resources required to implement business continuity.  When this activity is complete, an organization should have an understanding of in-scope products and services, and a list or “map” of the departments that support or deliver these products and services.

The graphic below provides an illustration of the relationship between products and services, departments, activities, and resources.  Note: Avalution recommends identifying activities and resources during the  business impact analysis , not during the scoping effort.

Define Risk Appetite At this point in the scoping effort, an organization should have a clear understanding of business continuity requirements and objectives, as well as an initial inventory of in-scope products, services, and departments.

The final activity in the scoping process is defining an organization’s risk appetite (the impacts that an organization is unwilling to tolerate or that are deemed to be unacceptable).  To reach consensus on this topic, an organization should leverage information from the previous two activities and present management with potential impacts associated with the inability to deliver in-scope products and services.  Management should subsequently give guidance on which impacts are unacceptable, to include the amount of downtime the organization is willing to tolerate.

Although potential impacts vary between organizations and industries, the following categories are a good starting point in understanding and defining potential impacts associated with a disruptive incident:

• Regulatory Impacts
• Legal and/or Contractual Impacts
• Customer Impacts
• Financial Impacts
• Operational Impacts
• Reputational Impacts

Based on guidance provided by management, an organization can formally define and document its risk appetite using criteria that describes impact that is unacceptable.  Downtime associated with products and services, departments, and resources that may exceed an organization’s risk appetite should be in scope of the business continuity program.

Conclusion Based on requirements and obligations, the importance of the organization’s products and services, and a documented risk appetite, an organization can document a formal scope statement that establishes the boundaries of the business continuity effort.

Organizations often find themselves developing, or trying to maintain business continuity programs, without a formal understanding or definition of the program’s scope.  This leads to a host of issues, including misallocation of resources, ill-defined preparedness objectives, an inability to maintain recovery strategies, and difficulty enforcing policy.  Effective scoping not only delivers focus, but it formalizes business continuity objectives, defines in-scope products and services, and facilitates agreement on risk appetite.

Stated simply, effective scoping is one of the surest ways to prevent (or address) ineffective business continuity programs and align a program’s scope with stakeholder expectations.

Business continuity and IT disaster recovery planning is all that we do. If you’re looking for help with building or improving your business continuity program, we can help.

Share This, Choose Your Platform!

Related posts.

Geopolitical Risk: 3 Techniques to Protect Your Business

APRA CPS 230: What You Need to Know Now

Business Continuity Plans Get Updates – But Few Feel Prepared for Trouble, Says New Riskonnect Report

Review our cookie policy.

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish.

Privacy Overview