A business continuity plan (BCP) is a short written document that says how your business keeps serving customers when something goes wrong: a ransomware attack, a fire, a flood, a long power cut or the loss of key staff. The template on this page gives you the full structure, a business impact analysis table and a one-page version for small firms. ERS IT Solutions has run backup, recovery and continuity work for Irish organisations from Blanchardstown, Dublin 15 since 1983.
What is a business continuity plan?
By definition, a business continuity plan is the agreed set of steps your business follows to keep its most important work going during a disruption and to get back to normal afterwards. It names who is in charge, which activities come first, how long each one can be down, where staff work from, how you talk to customers and how IT systems are restored.
A business continuity programme (program, in US spelling) is the cycle around the plan: analyse, plan, test, review and repeat. The template below works as a business continuity program template for an SME.
What is the purpose of a business continuity plan?
The purpose is to make decisions before the crisis, not during it. When systems are down and customers are ringing, nobody should be debating which system comes back first or who calls the insurer.
Why is a business continuity plan important?
The benefits are practical:
- Faster recovery, because the recovery order and contacts are already agreed.
- Less lost revenue, because critical work is protected first.
- Fewer data protection problems. GDPR Article 32 asks for "the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident" (GDPR Article 32).
- Better answers for customers, auditors and insurers who ask how you would cope. Many business interruption and cyber insurers ask about continuity planning and backups on proposal forms; see our guide to cyber insurance requirements in Ireland.
If your business falls under NIS2, continuity is a legal requirement rather than a good idea. Article 21 lists "business continuity, such as backup management and disaster recovery, and crisis management" among the measures in-scope organisations must take (NIS2 Article 21). As of 7 October 2026, Ireland's National Cyber Security Bill had not yet been published (Law Society Gazette; NCSC). Our NIS2 guide covers who is in scope.
What should a business continuity plan include?
Every good plan, whatever the size of the business, has the same core components:
- Scope and objectives: what the plan covers and what it aims to protect.
- Roles and responsibilities: a plan owner, a deputy and who decides to invoke the plan.
- Business impact analysis (BIA): your critical functions and how long each can be down.
- Risk assessment: the threats most likely to hit you.
- Recovery strategies: how each critical function keeps going or comes back.
- IT recovery: backups, recovery order, RTO and RPO for each system.
- Communication plan: staff, customers, suppliers, insurer, regulators.
- Contact lists: staff, IT provider, landlord, utilities, insurer, bank.
- Testing and review schedule.
- Version control and sign-off.
These are the elements auditors and insurers look for. The template below follows this order. If you want a business continuity plan diagram for the office wall, draw it as a simple flow: incident, assess, invoke the plan, recover critical functions in BIA order, communicate, return to normal, review.
Business continuity plan template
Copy this structure into a Word document or SharePoint page and fill in each section. A 10-page plan people read beats a 60-page plan nobody opens.
Section 1: Plan details
- Business name, plan owner and deputy (with mobiles)
- Version, date approved, next review date, where copies are kept (printed off site and in the cloud)
Section 2: Scope and objectives
- Sites, teams and services covered
- Objective, for example: "Keep customer orders and payroll running within one working day of any disruption."
Section 3: When to invoke the plan
- Triggers, for example: site unavailable, IT down for more than two hours, cyber attack, loss of a key supplier, many staff unavailable
- Who can invoke it, and how staff are told
Section 4: Business impact analysis
Use a table like this one. List every activity, then rank them.
| Critical function | Owner | Systems it needs | Impact if down 1 day | Maximum tolerable downtime | RTO | RPO |
|---|---|---|---|---|---|---|
| Taking customer orders | Sales manager | CRM, email, phones | Lost orders, unhappy customers | 1 day | 4 hours | 1 hour |
| Payroll | Finance | Payroll software, bank portal | Staff unpaid, legal risk | 3 days | 1 day | 24 hours |
| Accounts payable | Finance | Accounts package | Supplier delays | 5 days | 2 days | 24 hours |
| Website | Marketing | Hosting, DNS | Lost enquiries | 2 days | 1 day | 24 hours |
Section 5: Risk assessment
| Risk | Likelihood (1 to 5) | Impact (1 to 5) | Score | Main control |
|---|---|---|---|---|
| Ransomware | 3 | 5 | 15 | Offline backups, MFA, monitoring |
| Office unavailable (fire, flood) | 2 | 4 | 8 | Remote working, cloud systems |
| Internet outage | 3 | 3 | 9 | Backup 4G or second line |
| Loss of key person | 3 | 3 | 9 | Documented procedures, cross-training |
| Key supplier fails | 2 | 4 | 8 | Second supplier identified |
Section 6: Recovery strategies
For each critical function, write two or three lines: how it keeps running (manual workaround, another site, home working) and what is needed to restore it.
Section 7: IT and ICT disaster recovery
- Backup schedule and where backups are stored (one copy offline)
- Recovery order: identity and email first, then line-of-business systems, then file shares
- Who restores, and the IT provider's emergency number
- Link to your full disaster recovery plan
Section 8: Communication plan
- Staff: who calls whom (a phone tree), and a WhatsApp or SMS group that does not rely on company email
- Customers: holding message for the website and phones
- Suppliers, insurer, bank
- Data Protection Commission if personal data is breached: GDPR requires notification "not later than 72 hours" after you become aware of it, unless the breach is unlikely to result in a risk to people (GDPR Article 33)
Section 9: Contact list
Staff mobiles, IT provider, internet provider, landlord, utilities, insurer and policy number, bank, solicitor, Gardaí.
Section 10: Testing and review
- Tabletop exercise: twice a year
- Backup restore test: at least quarterly
- Full plan review: once a year and after any major change
Section 11: Sign-off
Approved by (director), date, next review date.
How do you do a business impact analysis (BIA)?
A business impact analysis lists every activity your business does, asks what happens if it stops for an hour, a day and a week, and ranks them. The output is your list of critical functions, each with an owner, the systems it depends on and the maximum time it can be down.
Run it as a one-hour workshop with each team lead. Ask three questions per activity: what does it cost us if this stops, who else is affected, and what is the longest we could survive without it? Put the answers in the table in Section 4.
What are RTO and RPO?
RTO (recovery time objective) is how quickly a system must be working again. RPO (recovery point objective) is how much data you can afford to lose, measured in time. An RPO of one hour means backups must run at least hourly.
The targets drive the cost. A four-hour RTO with a 15-minute RPO needs replication and a standby system; a two-day RTO with a 24-hour RPO can be met with nightly cloud backups. Set targets from the business impact analysis, then design IT to meet them. Forsa moved from a three-day recovery time to four hours after ERS virtualised its servers and added off-site replication (Forsa case study).
Simple business continuity plan template for a small business
If you have under 20 staff, a one-page plan is far better than none. Fill in these lines:
- Plan owner and deputy: names and mobiles.
- Our three most important activities and how long each can stop.
- If the office is unavailable: staff work from home on laptops; phones divert to mobiles.
- If IT is down: call our IT provider on (number); backups are at (location); last restore test (date).
- If we are hit by a cyber attack: disconnect affected devices, call IT, do not pay or reply to attackers, consider DPC notification.
- Who tells customers, and the holding message.
- Key contacts: insurer and policy number, bank, landlord, internet provider.
- Tested on (date) and next review (date).
Print it and keep a copy at home. A plan stored only on the server that has just failed is no help.
How do you test a business continuity plan?
Test it in three ways, from easiest to hardest. A tabletop exercise walks the team through a scenario ("it is Monday 9am and every file is encrypted") in an hour. A restore test proves backups work by recovering real systems. A full test switches a critical function to its backup arrangement for real.
After each test, write a short report: what was tested, what worked, what failed, actions and owners. That report is your business continuity plan testing template and the evidence an auditor will ask for.
Who owns the business continuity plan?
A director or the managing director owns the plan and is responsible for it being kept up to date. Day-to-day upkeep can sit with an operations or office manager. IT owns the technical recovery section, whether that is an internal person or a provider like ERS. Responsibility cannot sit with IT alone, because most decisions in a disruption are business decisions.
Business continuity vs disaster recovery vs crisis management
These terms overlap but are not the same:
| Covers | Typical owner | |
|---|---|---|
| Business continuity | Keeping the whole business running: people, premises, suppliers, customers, IT | Director |
| Disaster recovery | Restoring IT systems and data after an outage | IT lead or IT provider |
| Crisis management | Leadership decisions and communication in the first hours of a serious incident | Senior management |
| Operational resilience | The broader ability to absorb and adapt to disruption over time, a term used heavily by regulated financial firms | Board |
Disaster recovery is one chapter of business continuity. Our disaster recovery plan guide covers that chapter in depth.
Business continuity standards: ISO 22301 and NIST
ISO 22301 is the international standard for business continuity management systems. It sets out requirements to protect against, prepare for, respond to and recover from disruptions, and is written for organisations of all types and sizes (Standards Council of Canada listing of ISO 22301:2019). Few SMEs certify to it, but its structure (policy, BIA, risk assessment, strategy, exercises, review) is a sound framework to follow.
For a free NIST template, SP 800-34 includes a downloadable business impact analysis template and plan templates (NIST SP 800-34 Rev. 1), though it is heavier than most Irish SMEs need.
Business continuity plan examples by sector
The template stays the same; the critical function list changes. A manufacturing business continuity plan puts production control systems, raw material supply and dispatch first, and a supply chain business continuity plan names a second supplier for each critical input. Our Wellman International case study shows a system where "any failure of this application would result in a complete halt to plant production". A hotel plan covers bookings, check-in, payments and key cards. In the banking industry and other regulated financial services, the plan is built to the regulator's own resilience rules first.
COVID-19 added a lesson for every sector: a pandemic plan for business continuity needs a section for losing many staff at once and working from home at scale, with procedures written down so someone else can cover.
Do you need business continuity software or a consultant?
Most SMEs do not need business continuity software; a document in SharePoint with a printed copy works. Larger, multi-site organisations use software for BIAs, contacts and test records. Business continuity consultants and planners help run BIA workshops, write the plan and run exercises. ERS IT Solutions helps clients with business continuity planning as part of our backup and disaster recovery service, with a focus on the IT side: backups, recovery targets and restore testing. Our fastest disaster recovery return to operations is 45 minutes.
Is there a business continuity voucher in Ireland?
The Business Continuity Voucher, worth up to €2,500 in consultancy through the Local Enterprise Offices, was a COVID-19 support launched in March 2020 (Department of Enterprise). It was an emergency support for that period, and we could not find a current version of it in October 2026. Ask your Local Enterprise Office which grants and vouchers are open now.