A business continuity plan is a short written record of how your organization keeps serving clients when the office, the network or key people are unavailable. It names who decides, where the data lives, how staff keep working and who calls whom. It should be a few pages people can find and follow under stress.
The need is real in south Louisiana. When Hurricane Ida came ashore near Port Fourchon in August 2021, it left more than a million homes and businesses in Louisiana, Mississippi and Alabama without power. A week later, about 500,000 Louisiana customers were still in the dark. Ransomware can do the same to your systems on a sunny Monday.
Backup, disaster recovery and business continuity
These terms get used as if they mean the same thing, and mixing them up is how organizations end up with good backups and still lose a week. A backup is a copy of your data. Disaster recovery is the process of restoring systems, applications and data in a set order within a set time. Business continuity covers the whole organization while recovery is underway, including people, phones, locations, vendors and communication.
Two numbers tie them together. NIST defines the recovery point objective (RPO) as the point in time to which data must be recovered, which tells you how much recent work you can afford to lose. The recovery time objective (RTO) is how long a system can be down before it seriously hurts the business. If your RPO for the accounting system is one hour, a nightly backup won’t meet it.
Start with a business impact analysis
Before writing recovery steps, figure out what matters most. A business impact analysis can be a one-page spreadsheet with a row for each business function.
- What does this function depend on: applications, data, equipment, internet, phones, specific people and outside vendors?
- How long can it stop before you lose revenue, miss a deadline or break a client or regulatory commitment?
- How much data can you afford to re-enter or lose?
- Is there a manual workaround, and how long can you run on it?
Rank the results. The top items set your recovery order and your RTO and RPO targets, and the rest of the plan follows from that list.
A business continuity plan template: the sections to include
| Section | What to write down |
|---|---|
| Continuity team | Who declares an emergency, who leads recovery, who talks to clients and who talks to staff, each with a named backup person |
| Contact lists | Staff, key clients, vendors, your IT provider, internet and phone carriers, bank, insurance agent and landlord, kept on paper and outside your main systems |
| IT inventory | Each critical application and device, its version or model, vendor support contact, warranty status and license details |
| Backups | What is backed up, how often, where the copies live, how they are protected and who can restore them |
| Recovery steps | For each critical system, in priority order, matched to its RTO and RPO |
| Alternate ways of working | Remote access, laptops staff can take home, call forwarding on a cloud phone system, and a temporary location |
| Communication templates | Short pre-written messages for staff, clients and vendors |
| Insurance and money | Policy numbers and claim contacts for property, business interruption and cyber coverage, and how you will pay staff and vendors if banking access is disrupted |
| Power protection | Battery backup on servers and network gear, surge protection, and a plan for longer outages |
For our clients, server backups run hourly, are copied off-site daily, are immutable and are verified by screenshot. Microsoft 365 and Google Workspace data is backed up three times a day and is immutable too. All of it is stored in the US. Our guide to secure data backup explains each of those choices.
Write the ransomware section first
48%
of breaches in Verizon’s 2026 Data Breach Investigations Report involved ransomware, up from 44% the year before.
A storm takes out your building. Ransomware takes out your systems while the building is fine, and it often goes after backups first. Your plan should assume the network, email and file shares are unavailable or untrusted:
- Keep at least one backup copy that is offline or immutable, so an attacker with admin access can’t delete or encrypt it.
- Back up Microsoft 365 email, OneDrive, SharePoint and Teams separately from the built-in retention.
- Keep the plan, contact list and incident steps somewhere that works when your network doesn’t, including on paper.
- Know who to call first: your IT provider, your cyber insurer’s hotline and, if applicable, legal counsel. Many cyber policies require their approved responders.
Our ransomware guide covers prevention, and our post on what your IT partner should do when disaster hits covers the questions to ask your provider now.
Add a hurricane annex
The Atlantic hurricane season runs from June 1 to November 30. NOAA expected a below-normal 2026 season, but its National Weather Service director reminded businesses in August that inland flooding from a weak storm can still do serious damage, so prepare for every storm forecast for your area.
Your annex should say what happens before the season, when a storm is forecast and after it passes. For our clients, a named storm triggers a notice and checklist from us, a check of backups and the off-site copy, controlled shutdowns and UPS checks, and confirmation that remote work and cloud failover are ready. The full timeline is in our hurricane disaster recovery plan post.
Keep it alive
A plan that has never been tested is a guess. Three habits keep it honest:
- Run a tabletop exercise once a year. Walk the team through a scenario, such as ransomware on a Monday morning or a hurricane in September, and note where the plan breaks.
- Test real restores on a schedule: a file, a mailbox and a full system. A backup job that reports success isn’t proof you can recover.
- Debrief after every real event. Record what happened, how long recovery took and what to change, then update the plan.
Review the plan whenever you add a location, change a key system or lose a key person.
Continuity rules if you keep sensitive records
For healthcare practices, the HIPAA Security Rule requires a contingency plan with a data backup plan, a disaster recovery plan and an emergency mode operation plan. Testing and revising the plan, and analyzing which applications and data are most critical, are addressable parts of the same standard.
Accounting, tax and other financial firms covered by the FTC Safeguards Rule must have a written incident response plan covering roles and decision-making authority, internal and external communication, documentation, and how the plan will be reviewed after an event. A continuity plan that includes cyber incidents covers much of that ground, and our compliance services keep both documents current.
A plan that lives in someone’s head, or in a binder nobody has opened since it was written, needs an afternoon with this template. To work through it with us, book an intro call or read more about our business continuity services.
FAQ
Frequently asked questions
What is a business continuity plan?
A business continuity plan is a short written record of how your organization keeps serving clients when the office, the network or key people are unavailable. It names who decides, where the data lives, how staff keep working and who calls whom.
What is the purpose of a business continuity plan?
It keeps the business running while systems, data or the building are being recovered. It sets the order you restore things in, how much data and downtime each function can afford, and how staff, clients and vendors stay in touch.
How do you create a business continuity plan?
Start with a business impact analysis: list each business function, what it depends on and how long it can stop. Rank the results to set your recovery order, then write down the continuity team, contact lists, backups, recovery steps and alternate ways of working. Test it with a tabletop exercise once a year.
Sources: U.S. Energy Information Administration: Hurricane Ida caused at least 1.2 million electricity customers to lose power, 2021; NOAA: NOAA maintains prediction for below-normal Atlantic hurricane season, August 2026; Verizon 2026 Data Breach Investigations Report; NIST glossary: Recovery Point Objective (SP 800-34 Rev. 1); NIST glossary: Recovery Time Objective (SP 800-34 Rev. 1); NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems; 45 CFR 164.308 (HIPAA Security Rule, contingency plan); 16 CFR 314.4 (FTC Safeguards Rule, incident response plan).
