Business Continuity Plan Template: Free Guide for UK SMEs

Key Takeaways

• A business continuity plan template turns vague intentions into named people, systems and recovery times.
• Run a business impact analysis first, then set RTO and RPO per critical system.
• Keep at least one backup copy separate from the main network and prove you can restore from it.
• Report personal data breaches to the ICO within 72 hours where feasible if there is a risk to individuals.
• Test yearly: a tabletop exercise and a restore test find problems cheaply.

A business continuity plan template is a structured document that records how your organisation keeps its critical activities running, or restores them quickly, when something disrupts normal operations. For a UK SME, the useful version names the people, systems, suppliers and recovery times that matter, and fits on a few pages rather than a binder nobody opens.

This guide explains what a business continuity plan (BCP) must contain, how to run a business impact analysis, how to set recovery time and recovery point objectives, and how to test the result. It ends with a free, interactive template further down the page that you can complete, save, download and print.

I work in marketing at NetMonkeys, a Manchester-headquartered Microsoft Solutions Partner that supports IT for UK organisations, so the IT recovery sections reflect what tends to go wrong in practice: untested backups, single points of failure and nobody knowing who makes the call. Every external claim below was checked against the official sources cited, as at October 2026.

What is a business continuity plan?

A business continuity plan is a documented set of procedures that tells your organisation how to keep delivering its most important products and services during a disruption, and how to return to normal afterwards. It covers people, premises, technology, suppliers and communications.

The plan sits inside a wider discipline called business continuity management (BCM). The international standard for this discipline, ISO 22301:2019, is titled "Security and resilience — Business continuity management systems — Requirements". ISO's catalogue page, checked in October 2026, shows an amendment published in 2024 on climate action changes and notes that the standard is marked for revision. You do not need certification to benefit from its thinking, but its logic (understand the business, plan, exercise, review) is a sound spine for any SME plan.

What is the difference between a BCP and a disaster recovery plan?

A disaster recovery (DR) plan is the technical subset of a BCP: it covers restoring IT systems and data. A BCP is broader and answers a business question: how do we keep trading? A DR plan might restore your file server in six hours, but the BCP decides what staff do during those six hours.

Is a business continuity plan the same as an incident response plan?

No. An incident response plan deals with the immediate handling of a specific event, such as a cyber attack. The BCP takes over where operations are affected and needs to continue under degraded conditions. In practice the two should reference each other, and your cyber incident process should name the BCP as the next step.

↑ Back to Contents

Why do UK SMEs need a business continuity plan?

UK SMEs need a continuity plan because disruption rarely announces itself, and small organisations have fewer spare people, systems and cash reserves to improvise with. The causes are mundane as often as dramatic: a failed supplier, a flooded office, a lost laptop containing the only copy of a key file, a compromised email account, or a key member of staff suddenly unavailable.

The NCSC's NCSC Small Business Guide: Response and Recovery (reviewed October 2026) makes the same point from a cyber angle. It advises identifying the essential information and critical systems your business depends on, backing up regularly, testing that you can restore, and keeping a contact list that you can reach even if normal communications are down. It also suggests discussing cyber risk alongside physical, flood, legal and health and safety risks in regular management meetings, which is exactly the integrated view a BCP takes.

There are also practical commercial reasons. Larger customers increasingly ask suppliers to evidence continuity arrangements in tenders and due diligence, and insurers may ask what you would do after an incident. Our article on cyber insurance for UK businesses covers what insurers tend to look for.

↑ Back to Contents

What should a business continuity plan include?

A workable BCP includes ten core elements: scope and purpose, roles and activation, a business impact analysis, risk assessment, recovery objectives, continuity strategies, IT recovery, communications, supplier dependencies, and a testing and review schedule. The table below summarises each and the question it answers.

Keep it short enough to use under stress. A plan of 10 to 20 pages with checklists beats a 90-page policy document, and the interactive template below is built on that principle.

↑ Back to Contents

How do you run a business impact analysis (BIA)?

A business impact analysis identifies your critical activities and measures how quickly each one would hurt the organisation if it stopped. You run it by listing activities, scoring the impact over time, and recording the people, systems and suppliers each depends on.

What steps does a BIA involve?

1. List your activities. Think in terms of outputs: taking orders, invoicing, payroll, delivering a service, answering customers, regulatory reporting.
2. Assess impact over time. For each, ask what happens after one hour, one day, three days and a week without it: lost revenue, contractual penalties, safety, reputation, legal exposure.
3. Rank them. Group into critical (must resume within hours), important (within days) and deferrable.
4. Map dependencies. For each critical activity record the staff with the skills, the applications, data, premises, equipment and third parties required.
5. Agree the minimum level. Decide the minimum acceptable service level and the maximum tolerable outage.

What is a worked example of a BIA?

The following is an illustrative example for a fictional 40-person professional services firm; the figures are assumptions for demonstration, not benchmarks.

Notice that the ranking is driven by consequences, not by how much the IT team likes a system. Finance and operations leaders should own these decisions, with IT advising on feasibility. If you have outsourced IT, involve your provider early; our comparison of outsourced and in-house IT support explains where responsibilities usually sit.

↑ Back to Contents

What are RTO and RPO, and how do you set them?

Recovery time objective (RTO) is the longest you can tolerate a system or process being unavailable. Recovery point objective (RPO) is the most data, measured in time, you can afford to lose. An RPO of four hours means your backups or replication must capture changes at least every four hours.

How do RTO and RPO differ in practice?

RTO is about downtime and RPO is about data loss; a system can have a short RTO and a long RPO, or the reverse. A customer database might need a one-hour RPO and a four-hour RTO, whereas an archive of old projects might tolerate a day's loss and a week's wait.

How do you choose realistic objectives?

Start with the business impact, then test what your technology can deliver. The most common mistake is writing a four-hour RTO on paper while the only restore path takes two days of data transfer. Run an actual restore and time it. Tighter objectives cost more, so agree them with whoever holds the budget. The NCSC's guidance on backups, which advises regular copies and tested restores, is the practical baseline; for ransomware resilience, keep at least one copy that an attacker with your admin credentials cannot reach or alter.

Your managed cloud provider or IT partner can show what is realistic for your set-up, including cloud replication and immutable backups.

↑ Back to Contents

Who does what, and how should you communicate during a disruption?

Name a plan owner, a deputy and a small continuity team with defined responsibilities, and write down how each person is contacted. In a crisis, ambiguity about who decides wastes the first and most valuable hours.

What roles does a continuity team need?

• Plan owner (incident lead): declares the plan active and makes final decisions.
• Deputy: takes over if the lead is unavailable.
• IT lead or provider contact: coordinates technical recovery.
• Communications lead: staff, customer, supplier and media messages.
• People lead: welfare, working arrangements, health and safety.
• Finance lead: emergency purchasing, insurance claims, cash flow.

In a small business one person may hold several roles, but make sure the deputy is a different person. The NCSC also advises defining trigger points at which a decision passes to senior management, for example whether to take a website offline.

What should a communications plan cover?

It should list each audience, the channel, the owner and a holding message prepared in advance. Do not rely only on the systems that may be down: if email is unavailable, you need a mobile number list, a messaging group or a pre-agreed alternative. The NCSC recommends keeping contact details where you can reach them even if normal communications are disrupted, and checking them every couple of months.

Do you have to tell the ICO if data is involved?

If the disruption involves a personal data breach likely to risk people's rights and freedoms, the ICO guidance on personal data breaches says to report it as soon as possible and where feasible within 72 hours; where the risk to individuals is high, you must also tell them without undue delay. Build this prompt into your plan so the decision is made deliberately, not discovered on day three. For cyber events specifically, see our overview of cybersecurity risks for small businesses.

↑ Back to Contents

How should you plan IT recovery within a continuity plan?

Plan IT recovery by listing every system in order of restoration, with its owner, location of data, backup method, RTO, RPO and vendor support route. Recovery order matters: identity and networking usually come before applications, and applications before user convenience.

What belongs in the IT recovery section?

• An asset and application register with business owners.
• Backup scope, frequency, retention, location and the date of the last successful restore test.
• Recovery order, for example internet connectivity, identity and email, line-of-business systems, then file shares.
• Administrator access arrangements, including break-glass accounts held securely offline, so a single locked account cannot block recovery.
• Supplier and licence details, support numbers and contract references.
• Alternative ways of working: remote access, personal device rules, paper forms.

How does cyber attack recovery differ from a power cut?

After a cyber attack you must not simply restore into the same compromised environment. Restore from clean copies, reset credentials and confirm the attacker is out before reconnecting. Services such as managed endpoint detection and response help detect and contain the threat, while a cyber security audit can reveal the gaps beforehand. Cyber Essentials controls such as patching, malware protection and access control reduce the likelihood that you need the plan at all, and our cybersecurity best practice guide sets out the wider measures.

If you rely on a provider for out-of-hours help, record how to reach their 24/7 IT helpdesk or remote support team and what their contract covers, and keep a current IT support handover checklist so documentation survives staff or supplier changes.

↑ Back to Contents

Which disruption scenarios should your plan cover?

Plan for the effect of a disruption, not for every possible cause. Most scenarios reduce to five effects: loss of IT or data, loss of premises, loss of people, loss of a supplier, and loss of utilities or connectivity. One response per effect covers many causes.

What does the supply chain have to do with it?

Your continuity is only as strong as the services you depend on. List cloud platforms, payment providers, telecoms and any outsourced function, and record what you would do if each failed for a day. Our overview of cybersecurity breaches explains how incidents arise and spread.

Should cyber attack be a separate scenario?

Treat it as a cause of IT loss, but give it its own checklist because the response differs: evidence preservation, credential resets, regulator and insurer notifications, and a staged return to service. If you hold personal data, the breach reporting decision belongs in that checklist.

↑ Back to Contents

How often should you test and review a business continuity plan?

Review the plan at least annually and after any significant change or incident, and exercise it at least once a year. An untested plan is a hypothesis, and tests are how you find the missing phone number or the backup that will not restore.

What types of exercise work for an SME?

• Walk-through: the team reads the plan aloud and checks each step is clear and assigned.
• Tabletop exercise: a facilitator presents a scenario, such as ransomware on a Friday afternoon, and the team talks through decisions. The NCSC points to its Exercise in a Box tool for this purpose.
• Technical test: restore a file set, fail over a service or work from the alternative location for a day.

What should you record after a test?

Record the date, scenario, participants, what worked, what failed, actions with owners and deadlines, and the date the plan was updated. The template below includes a log for this. Treat a failed test as a good result: it found the weakness cheaply.

A first-year schedule that works for many small organisations is a walk-through at plan sign-off, a restore test within the first quarter, a tabletop at six months and a full review at twelve.

What are the most common business continuity planning mistakes?

The most common mistakes are writing a plan once and never testing it, setting recovery targets nobody has validated, and storing the plan only on the systems it is meant to help restore. Each is easy to avoid once you know to look for it.

• Copying a generic plan without adapting it. A template is a prompt for decisions, not a substitute for making them. Your critical activities will differ from any other firm's.
• Treating it as an IT project. Technology recovery is one chapter. Staff, premises, customers and suppliers need owners from the business.
• No deputy. If the plan owner is away or unwell, the plan stalls.
• Out-of-date contacts. People change roles and numbers. Check the contact sheet every couple of months, as the NCSC advises.
• Assuming the cloud means no risk. Cloud services reduce some risks but not account compromise, accidental deletion or a provider outage. Understand what your Microsoft 365 or other subscriptions do and do not retain.
• Skipping the dependency map. A critical process may depend on a spreadsheet on one laptop or a single administrator password.
• Never rehearsing the communications. The first customer message is written under pressure unless a holding statement already exists.

Who should help write the plan?

Include a director, the heads of operations and finance, whoever manages HR, and your IT lead or provider. A two-hour workshop with these people usually produces the first usable draft. If you have no in-house IT, a provider can supply the technical detail and help test it; our guide on how to choose an IT support company lists the questions worth asking about continuity and recovery commitments.

How much does a continuity plan cost?

Writing the document costs mainly management time. The larger costs sit in the recovery capabilities, such as backup tooling, a second connection or an alternative site, and they scale with how tight your RTOs and RPOs are. Prices vary by provider and set-up, so obtain quotes against your agreed objectives rather than guessing.

↑ Back to Contents

Where can I get a free business continuity plan template?

You can complete the free interactive template directly below this section. It has eight parts covering plan control, critical activities, recovery objectives, roles, communications, IT recovery, premises and people, and testing. Everything you enter is for your own use; you can save progress, download the result and print it.

How do I use the template?

1. Complete the plan control and critical activities sections first with the leadership team.
2. Agree recovery times with the people who would bear the consequences, then ask IT or your provider whether they are achievable.
3. Fill in contacts with mobile numbers and non-work email addresses, not only office lines.
4. Tick the checklist items only when they are actually in place.
5. Print a paper copy and store a second copy outside your main systems, because the plan is no use if it sits on the server that has failed.

The template is a starting point and does not replace advice for regulated sectors. If you want help running a business impact analysis or testing recovery, our managed IT support team can work through it with you, and our small business IT support page explains how we work with smaller organisations.

↑ Back to Contents

Business continuity plan template: what should you do next?

Use the business continuity plan template to get a first version written within a fortnight, then improve it through testing rather than polishing it in isolation. Start with your three most critical activities, set honest RTOs and RPOs, name a deputy for every role and prove that one restore works.

• Complete the template and have a director sign it off.
• Store printed and offline copies, and share relevant parts with your IT provider.
• Book a tabletop exercise and a restore test in the calendar now.
• Review the plan every twelve months and after any major change.

If you would like help turning this into a tested plan, contact NetMonkeys to talk it through.

↑ Back to Contents

Frequently Asked Questions (FAQs)

↑ Back to Contents