business continuity plan (bcp) should be

Learn how to improve your organizational resilience

Quickly and easily produce a professional Business Continuity Plan

Respond with confidence and recover quickly when disaster strikes

Take your business from unprepared to unstoppable in one week

Frequently Asked Questions

How do you write a business continuity plan.

Producing a good Business Continuity Plan requires specific information. If you purchase BCP Builder’s template, you can feel confident that your Plan will include all the information required. The instructions will help you work through the planning process at your own pace, without confusion. Your subscription includes access to online training and coaching to make your planning journey as smooth as possible.

What is a Business Continuity Plan Template?

A Business Continuity Plan focuses on the effect of any disruption rather than the cause. The goal is to effectively deal with any negative incidents that could impact your business.

A good Business Continuity Plan should be clear, concise, direct and easily understandable. You can write a plan that is completely relevant to your business with BCP Builder’s unique interactive design. Most of the entry areas are free text, this means that you can layout the information in the best way for your organization. 

This Template is based on the  Business Continuity Institute Good Practice Guidelines and the requirements of ISO 22301:2012. This means that you can write your plan in confidence, knowing that you are meeting all requirements.

What are the elements of a Business Continuity Plan?

• Company Information
• Relocation Site
• Service Providers
• Key Suppliers
• Key Clients
• Essential Equipment
• Business Impact Analysis
• Risk and Threat Assessment
• Activation and Stand-Down
• Incident Response Procedures
• Staff Contact List
• Emergency Services

How do I access my Business Continuity Plan?

In an emergency, you are unlikely to have the printed version of your plan with you. By using BCP Builder you can simply login online and download the latest copy with confidence.

• BCP Builder
• Privacy Policy
• Terms & Conditions

• Sustainability
• Risk Management

Business Continuity Plan (BCP)

Our BCP details policies and procedures for responding to large-scale disasters to ensure the safety of customers and all ANA Group directors and employees, minimize the impact on management and on society as a whole, and resume normal business operations as quickly as possible.

Improve, reinforced communication networks

• Deploy emergency use radios and satellite telephones
• Conduct regular employee safety confirmation drills

Backup facility construction, functional improvement

• Implement regular joint drills and training at backup facilities
• Ensure equipment and software are up-to-date at all times
• Conduct equipment operation drills at backup facilities

We plan to develop and distribute education and training materials teaching employees how to protect themselves while engaged in the safety evacuation of customers in the immediate aftermath of a large-scale disaster.

Information Technology Business Continuity Plan (IT-BCP)

The ANA Group uses many systems for business management. Establishing an information technology business continuity plan (IT-BCP) is essential for safe and stable continuation of our business. The ANA Group is engaged in a five-year project to build an IT-BCP environment for all systems. This project takes into account the damage projections for an earthquake occurring directly under the Tokyo metropolitan area, as estimated by the Central Disaster Prevention Council operated by Japan's Cabinet Office. We plan to reconstruct multiple lifeline systems in stages in a highly seismically isolated data center by the end of fiscal 2018. In parallel, we are preparing a backup data center in a remote location as part of disaster recovery (DR) plans that will allow us to continue business operations by switching to a backup data center from our main data center during a disaster. The system platform of the new data center will make use of virtualization and other advanced IT technologies, contributing to both enhanced system resilience and cost reductions. The ANA Group conducts tests at least once a year to ensure business continuity and system recovery in order to accurately and promptly identify IT risks that could have a significant impact on our business and respond appropriately in an emergency. Through these trainings and processes, we will continue to improve both hardware and software to continue to provide safe and stable services and fulfill our responsibilities as an essential social infrastructure.

• Search Search Please fill out this field.
• Business Continuity Plan Basics
• Understanding BCPs
• Benefits of BCPs
• How to Create a BCP
• BCP & Impact Analysis
• BCP vs. Disaster Recovery Plan

Frequently Asked Questions

• Business Continuity Plan FAQs

The Bottom Line

• Investopedia

What Is a Business Continuity Plan (BCP), and How Does It Work?

Pete Rathburn is a copy editor and fact-checker with expertise in economics and personal finance and over twenty years of experience in the classroom.

Investopedia / Ryan Oakley

What Is a Business Continuity Plan (BCP)? 

A business continuity plan (BCP) is a system of prevention and recovery from potential threats to a company. The plan ensures that personnel and assets are protected and are able to function quickly in the event of a disaster.

Key Takeaways

• Business continuity plans (BCPs) are prevention and recovery systems for potential threats, such as natural disasters or cyber-attacks.
• BCP is designed to protect personnel and assets and make sure they can function quickly when disaster strikes.
• BCPs should be tested to ensure there are no weaknesses, which can be identified and corrected.

Understanding Business Continuity Plans (BCPs)

BCP involves defining any and all risks that can affect the company's operations, making it an important part of the organization's risk management strategy. Risks may include natural disasters—fire, flood, or weather-related events—and cyber-attacks . Once the risks are identified, the plan should also include:

• Determining how those risks will affect operations
• Implementing safeguards and procedures to mitigate the risks
• Testing procedures to ensure they work
• Reviewing the process to make sure that it is up to date

BCPs are an important part of any business. Threats and disruptions mean a loss of revenue and higher costs, which leads to a drop in profitability. And businesses can't rely on insurance alone because it doesn't cover all the costs and the customers who move to the competition. It is generally conceived in advance and involves input from key stakeholders and personnel.

Business impact analysis, recovery, organization, and training are all steps corporations need to follow when creating a Business Continuity Plan.

Benefits of a Business Continuity Plan

Businesses are prone to a host of disasters that vary in degree from minor to catastrophic. Business continuity planning is typically meant to help a company continue operating in the event of major disasters such as fires. BCPs are different from a disaster recovery plan, which focuses on the recovery of a company's IT system after a crisis.

Consider a finance company based in a major city. It may put a BCP in place by taking steps including backing up its computer and client files offsite. If something were to happen to the company's corporate office, its satellite offices would still have access to important information.

An important point to note is that BCP may not be as effective if a large portion of the population is affected, as in the case of a disease outbreak. Nonetheless, BCPs can improve risk management—preventing disruptions from spreading. They can also help mitigate downtime of networks or technology, saving the company money.

How to Create a Business Continuity Plan

There are several steps many companies must follow to develop a solid BCP. They include:

• Business Impact Analysis : Here, the business will identify functions and related resources that are time-sensitive. (More on this below.)
• Recovery : In this portion, the business must identify and implement steps to recover critical business functions.
• Organization : A continuity team must be created. This team will devise a plan to manage the disruption.
• Training : The continuity team must be trained and tested. Members of the team should also complete exercises that go over the plan and strategies.

Companies may also find it useful to come up with a checklist that includes key details such as emergency contact information, a list of resources the continuity team may need, where backup data and other required information are housed or stored, and other important personnel.

Along with testing the continuity team, the company should also test the BCP itself. It should be tested several times to ensure it can be applied to many different risk scenarios . This will help identify any weaknesses in the plan which can then be identified and corrected.

In order for a business continuity plan to be successful, all employees—even those who aren't on the continuity team—must be aware of the plan.

Business Continuity Impact Analysis

An important part of developing a BCP is a business continuity impact analysis. It identifies the effects of disruption of business functions and processes. It also uses the information to make decisions about recovery priorities and strategies.

FEMA provides an operational and financial impact worksheet to help run a business continuity analysis. The worksheet should be completed by business function and process managers who are well acquainted with the business. These worksheets will summarize the following:

• The impacts—both financial and operational—that stem from the loss of individual business functions and process
• Identifying when the loss of a function or process would result in the identified business impacts

Completing the analysis can help companies identify and prioritize the processes that have the most impact on the business's financial and operational functions. The point at which they must be recovered is generally known as the “recovery time objective.”

Business Continuity Plan vs. Disaster Recovery Plan

BCPs and disaster recovery plans are similar in nature, the latter focuses on technology and information technology (IT) infrastructure. BCPs are more encompassing—focusing on the entire organization, such as customer service and supply chain. 

BCPs focus on reducing overall costs or losses, while disaster recovery plans look only at technology downtimes and related costs. Disaster recovery plans tend to involve only IT personnel—which create and manage the policy. However, BCPs tend to have more personnel trained on the potential processes. 

Why Is Business Continuity Plan (BCP) Important?

Businesses are prone to a host of disasters that vary in degree from minor to catastrophic and business continuity plans (BCPs) are an important part of any business. BCP is typically meant to help a company continue operating in the event of threats and disruptions. This could result in a loss of revenue and higher costs, which leads to a drop in profitability. And businesses can't rely on insurance alone because it doesn't cover all the costs and the customers who move to the competition.

What Should a Business Continuity Plan (BCP) Include?

Business continuity plans involve identifying any and all risks that can affect the company's operations. The plan should also determine how those risks will affect operations and implement safeguards and procedures to mitigate the risks. There should also be testing procedures to ensure these safeguards and procedures work. Finally, there should be a review process to make sure that the plan is up to date.

What Is Business Continuity Impact Analysis?

An important part of developing a BCP is a business continuity impact analysis which identifies the effects of disruption of business functions and processes. It also uses the information to make decisions about recovery priorities and strategies.

FEMA provides an operational and financial impact worksheet to help run a business continuity analysis.

These worksheets summarize the impacts—both financial and operational—that stem from the loss of individual business functions and processes. They also identify when the loss of a function or process would result in the identified business impacts.

Business continuity plans (BCPs) are created to help speed up the recovery of an organization filling a threat or disaster. The plan puts in place mechanisms and functions to allow personnel and assets to minimize company downtime. BCPs cover all organizational risks should a disaster happen, such as flood or fire.  

Federal Emergency Management Agency. " Business Process Analysis and Business Impact Analysis User Guide ," Pages 15 - 17. Accessed Sept. 5, 2021.

Business Essentials

Small Business Insurance

Tech Companies

Government & Policy

Small Business

• Terms of Service
• Editorial Policy
• Privacy Policy
• Do Not Sell My Personal Information

By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.

• Comprehensive Financial Plan
• Investment Management
• Business Planning
• Insurance Management
• Legacy Planning
• Family Wealth Program
• Professional Partnerships
• Client Center

TQM Wealth Partners, LLC’s Business Continuity Plan

TQM Wealth Partners has developed a Business Continuity Plan on how to respond to events that significantly disrupt our business. Since the timing and impact of disasters and disruptions is unpredictable, we will have to be flexible in responding to actual events as they occur. With that in mind, we are providing you with this information on our business continuity plan.

Contacting Us – If after the occurrence of a significant business disruption you cannot contact us as you usually do at 781-990-3599, you should go to our website at: www.tqmwealthpartners.com. If you cannot access us through either of those means, you can contact your account’s custodian for instructions on how you access to funds and securities, enter orders and process other trade-related, cash and security transfer transactions for your account. Charles Schwab, Inc. can be contacted directly at 800-515-2157.

Our Business Continuity Plan – We plan to quickly recover and resume business operations after a significant business disruption and respond by safeguarding our employees and property, making a financial and operational assessment, protecting the firm’s books and records, and allowing our clients to transact business. In short, our business continuity plan is designed to permit our firm to resume operations as quickly as possible, given the scope and severity of the significant business disruption. Our business continuity plan addresses: data backup and recovery; all mission critical systems; financial and operational assessments; alternative communications with clients, employees, and regulators; alternate physical location of employees; critical supplier, and contractor; regulatory reporting; and assuring our clients prompt access to their funds and securities if we are unable to continue our business.

Varying Disruptions – Significant business disruptions can vary in their scope, such as only our firm, a single building housing our firm, the business district where our firm is located, the city where we are located, or the whole region. Within each of these areas, the severity of the disruption can also vary from minimal to severe. In a disruption to only our firm or the building housing our firm, we will transfer our operations to a local site when needed and expect to recover and resume business as quickly as possible. In a disruption affecting our business district, city, or region, we will transfer our operations to a site outside of the affected area, and recover and resume business within a reasonable time period. If the significant business disruption is so severe that it prevents us from remaining in business, we will assure our client’s prompt access to their funds and securities.

For more information – If you have questions about our business continuity planning, you can contact us at 781-990-3599 or [email protected] .

• Advisera Home

Knowledgebase

Partner Panel

ISO 22301 Documentation Toolkits

Iso 22301 training.

• Documentation Toolkits
• White Papers
• Templates & Tools

By Standard

• ISO in General
• Live Consultations
• Consultant Directory
• For Partners

Dejan Kosutic

• Get Started

ISO 27001 & ISO 22301 Knowledge base

Business continuity plan: how to structure it according to iso 22301.

In my experience, companies usually find two things in their business continuity or information security management to be the most difficult: risk assessment, and business continuity planning. Here I’ll give you some tips on business continuity plans (BCP).

ISO 22301 business continuity plan should include Purpose, scope and users, Reference documents, Assumptions, Roles and responsibilities, Key contacts, Plan activation and deactivation, Communication, Incident response, Physical sites and transportation, Order of recovery for activities, Recovery plans for activities, Disaster recovery plan, Required resources, and Restoring and resuming activities from temporary measures.

What is a business continuity plan?

According to ISO 22301 , business continuity plan is defined as “documented procedures that guide organizations to respond, recover, resume, and restore to a pre-defined level of operation following disruption.” (clause 3.5)

This basically means that BCP focuses on developing plans/procedures, but it doesn’t include the analysis that forms the basis of such planning, nor the means of maintaining such plans – all these are required elements of business continuity management that are necessary for enabling successful contingency planning.

To read more about analysis, see Five Tips for Successful Business Impact Analysis , and to find out how to interpret the analysis, read Can business continuity strategy save your money? .

Business continuity plan example

Here’s what I found to be the optimal structure for the business continuity plan for smaller and midsize companies, and what each section should include:

Purpose, scope and users – why this plan is developed, its objectives, which parts of the organization it covers, and who should read it.

Reference documents – to which documents does this plan relate? Normally, these are Business Continuity Policy, Business Impact Analysis, Business Continuity Strategy, etc.

Assumptions – the prerequisites that need to exist in order for this plan to be effective.

Roles and responsibilities – who will be responsible for managing the disruptive incident, and who is authorized to perform certain activities in case of a disruptive incident – e.g. activation of the plans, urgent purchases, communication with media, etc.

Key contacts – contact details for persons who will participate in the execution of the business continuity plan – this is usually one of the annexes of the plan.

Plan activation and deactivation – in which cases can the plan be activated, and the method of activation; which conditions need to exist to deactivate the plan. Communication – which communication means will be used between different teams and with other interested parties during the disruptive incident. Who is in charge of communicating with each interested party, and the special rules of communication with media and government agencies.

Incident response – how to react initially to an incident in order to reduce the damage – this is very often an annex to the main plan.

Physical sites and transportation – which are the primary and alternative sites, where the assembly points are, and how to get from primary to alternative sites.

Order of recovery for activities – list of all the activities, with precise Recovery Time Objective (RTO) for each.

Recovery plans for activities – description of step-by-step actions and responsibilities for recovering manpower, facilities, infrastructure, software, information, and processes, including interdependencies and interactions with other activities and external interested parties – these are very often annexes to the main plan. To read more about them, see How to write business continuity plans?

Disaster recovery plan – this is normally a type of recovery plan that focuses on recovering the information and communication technology infrastructure. To read more about the relationship between disaster recovery and business continuity, see Disaster recovery vs business continuity .

Required resources – a list of all the employees, third-party services, facilities, infrastructure, information, equipment, etc. that are necessary to perform the recovery, and who is responsible to provide each of them.

Restoring and resuming activities from temporary measures – how to restore business activities back to business-as-usual once the disruptive incident has been resolved.

What I like about ISO 22301 is that it requires all the elements that are necessary for this plan to be useful in case of a disaster (or any other disruption in a company’s activities). However, no standard can help you unless you understand this task seriously – a properly written and comprehensive plan can save your company in tough times, while a superficially written plan will only make things worse.

Click here to see a sample  Business Continuity Plan .

Writing a business continuity plan according to ISO 22301

Free webinar explains the basics about business continuity plans and how to structure them

You may unsubscribe at any time. For more information, please see our privacy notice .

Breadcrumb navigation

Business continuity plan.

Contact NEC »

01 June 2020 As Singapore moves into its three-phased approach in easing Circuit Breaker measures from 02 June 2020, NEC APAC employees (including those seconded to customers’ sites) serving essential services will return to their positions with staggered work hours and continue maintaining the earlier precautionary measures mandated by the government. In addition to the SafeEntry check-in system implemented by the building management, NEC has appointed Safe Management Officers in every department to ensure that other measures, including safe-distancing, wearing of masks at all times and installing TraceTogether app on their devices, are strictly adhered to. The rest of NEC’s employees will continue working from home during this time. NEC is also encouraging all staff to conduct business meetings with colleagues and external parties virtually where possible. NEC will continue its weekly disinfection of its workplaces according to guidelines from MOH and NEA, and will do our best to ensure any potential disruptions are minimal. We appreciate your kind understanding. Should you require any further clarification or assistance, please contact us at this number: +65 62738333

07 April 2020 (Updated on 21 April 2020) In order to minimize further spread of COVID-19, the Singapore Government announced on 03 April 2020 that most workplaces, except for essential services and key economic sectors, will close from 07 April to 04 May 2020. (Update: The Singapore Government announced on 21 April that the circuit breaker period will be extended until 01 June 2020.) Effective today, all NEC employees, except for those supporting customers in essential services, will work from home until further notice. For the limited number of employees who are not working from home, including staff who are seconded to customer sites, we will be implementing heightened precautionary measures to ensure safety of customers and our staff. NEC APAC will continue its weekly disinfection of its workplaces according to guidelines from MOH and NEA. We will do our best to ensure any potential disruptions are minimal, and we appreciate your understanding as we navigate these uncertain times. Should you require any further clarification or assistance, please contact us at this number: +65 62738333

26 March 2020

• Implement telecommuting for employees who are not required to be on-site and encourage video conferencing where possible.
• Increased frequency in disinfection and cleaning of office premises.
• Travel restrictions for both business and personal trips.
• Mandatory Stay-Home Notice for employees returning from all overseas trips.

We appreciate your understanding as we navigate these uncertain times. Should you require any further clarification or assistance, please contact us at this number: +65 62738333

13 March 2020

The employee was tested on 12 March, and NEC APAC was informed of the confirmation this afternoon.

The employee was last in our office on 12 February, and has been working from home since.

The Ministry of Health (MOH) has started a contact tracing exercise to identify staff and individuals who might have had contact with the affected employee.

Following the change in the Disease Outbreak Response System Condition (DORSCON) alert level from ‘Yellow’ to ‘Orange’, NEC APAC activated its Business Continuity Plans (BCP) on 7 February, and split its employees into office and home-based teams. This is to ensure that normal business operations can continue during emergencies. To protect our employees based in the office, we are also periodically disinfecting and cleaning our premises according to guidelines from MOH and National Environment Agency (NEA).

As we navigate this period of uncertainty, we will do our best to safeguard the health and safety of our staff. We will provide every possible support for the affected employee and their family, and ensure the operations of NEC APAC and our customers are not affected during this trying time.

21 February 2020 Since the change of DORSCON alert level to Orange, both NEC and the building management have implemented precautionary measures to ensure a safe environment for all tenants and visitors to the building.

To strengthen our defences, and to better manage COVID-19 detection, there is now compulsory temperature screening and health and travel declarations for all persons before each entry into the building.

In addition, the building management has conducted thorough disinfection of the common areas.  NEC has also engaged a cleaning company to perform intensive disinfection and cleaning of its entire office premises, including all the meeting rooms.

Our office and home-based teams have collaborated well while working in different locations to ensure normal business operations.

With effect from 24 Feb, the two teams will swap working locations to ensure the continuous support of business operations.

Should you require any further clarification or assistance, please contact us at this number: +65 62738333

7 February 2020 NEC has been closely monitoring the Novel Coronavirus situation. In response to the change in alert level of the Disease Outbreak Response System Condition (DORSCON) as issued by the Ministry of Health, the NEC Asia Pacific Business Continuity Plan (BCP) has been put into immediate effect. Under the BCP, all Business Division/Project Team/Business Support Unit will be separated into office and home-based teams. This is to ensure that normal business operations can continue. The two teams shall not have any inter-personal interactions to mitigate the potential risks of infection and also to ensure that employees are adequately protected to continue meeting and protecting our customers’ interests. Should you require any further clarification or assistance, please contact us at this number: +65 62738333

29 January 2020 In light of recent world events, NEC would like to highlight that we have in place a robust Business Continuity Plan (BCP) within NEC to hedge against any threats to the business so as to protect our customers’ interest. Such threats include pandemic, fires, floods, hazardous chemical spills and any other short or long-term disasters, either natural or man-made. The BCP is focused in scope, to coordinate the recovery of NEC’s critical business functions in such events. In view of the Novel Coronavirus epidemic, NEC has implemented additional precautionary measures, in accordance with guidelines from the relevant authorities. Employees who have recently travelled to/from mainland China will be placed on Leave of Absence (LOA) for a period of 14 days, starting from the first day after their return to Singapore.   All employees with recent travel histories are required to monitor their own health closely for a period of 14 days upon return to Singapore. Further updates, if any, will be shared here on our website. Thank you for your patience. Should you require further clarification or assistance, please contact us at this number: +65 62738333