Business Continuity Plan: How to Write One in 7 Steps

A business continuity plan is a written guide to keeping your most important services running during a disruption, such as a cyber attack, a system outage or a flood. Many Australian organisations have a plan on paper. However, fewer have one that people can follow at 2am.

First, this guide breaks the job into seven steps. It also links to a business continuity plan template so you do not start from a blank page.

Business Continuity Plan Steps 1 to 4: Scope, Services, Impact and Targets

1. Set the scope. Decide which sites, teams and systems the plan covers, and who signs it off.
2. List critical services. Name the activities that bring in money, protect people or meet legal duties.
3. Run a business impact analysis. Ask what happens, hour by hour, if each service stops. Our guide to business impact analysis shows how.
4. Set recovery targets. For each service, agree a recovery time objective (how fast it must return) and a recovery point objective (how much data loss is acceptable).

Also, keep the first version small. Five or six critical services are enough to start.

Steps 5 to 7: Strategies, Written Plan and People

5. Choose recovery strategies. Options include backups, a second site, remote work, manual workarounds or a supplier that can step in.
6. Write the plan. Give each service a short page: who leads, who to call, what to do in the first hour and what comes next.
7. Assign roles and train people. Name a leader and a backup for every task, then walk the team through their part.

Finally, include contact lists, supplier details and the location of offline copies. If your network is down, the plan must still be reachable.

What a Good Business Continuity Plan Contains

Most effective plans share the same core sections. The table above sums them up, and the list below adds the detail.

• Purpose, scope and the people who approved it
• Critical services with recovery targets
• Activation criteria, so everyone knows when to start
• Response roles and contact details
• Recovery steps for people, premises, technology and suppliers
• Communication templates for staff, customers and regulators

For deeper detail, the ISO 22301 standard describes good practice for business continuity management if you want to go further.

Test the Business Continuity Plan at Least Once a Year

An untested plan is a guess. Run a tabletop exercise once a year: pick a realistic scenario, such as ransomware or a power outage, and talk through what each person would do.

Next, write down every gap you find, then fix it. Review the plan sooner if you change systems, suppliers, sites or key staff. Treat it like a fire drill rather than a one-off project.

It also helps to involve the people who would actually do the work. Operations, IT, finance and communications each own a piece, so ask each team to review its own page. Because they know the detail, they will spot missing steps faster than a single author could.

Common Business Continuity Plan Mistakes

Plans usually fail for ordinary reasons. For example, the plan is too long to read under stress, or contact details are out of date.

In other cases, nobody owns it, or it sits on the same server that has just failed.

To avoid those problems, start by keeping each page short, naming one owner and storing a printed or offline copy. If you want an outside view, a cyber compliance assessment can show where your continuity and cyber plans overlap, and our cyber incident response plan template covers the cyber side.