Business continuity plan template UK

This business continuity plan template gives a UK SME a copyable working document for use during disruption. Replace the bracketed prompts, remove examples that do not apply, and keep the finished plan somewhere authorised people can reach when normal systems are unavailable.

This is a template companion, not another explanation of continuity theory. If you have not yet agreed your critical activities, recovery time objectives or disruption scenarios, use my business continuity plan guide for UK SMEs first. Then return here to capture the decisions in an operational format.

Business continuity plan template instructions

Copy everything from "Document control" onwards into your preferred controlled document. A Word file, shared document or knowledge base page is fine, but export an offline PDF after each approved update.

Replace every square-bracketed prompt, delete the guidance, confirm contact details, test access, obtain approval and record where offline copies are held.

Do not put passwords, recovery codes or sensitive personal details directly in the plan. Reference the approved password manager, sealed recovery pack or restricted directory where authorised responders can obtain them.

Document control

Plan title: [Organisation name] business continuity plan
Plan owner: [Name and role]
Deputy owner: [Name and role]
Version: [For example, 1.0]
Approved by: [Name and role]
Approval date: [DD Month YYYY]
Next review date: [DD Month YYYY]
Classification: [For example, confidential]
Offline copies held at: [Locations or named custodians]

Revision history

Purpose, scope and activation

Purpose

This plan sets out how [organisation name] will protect people, maintain priority activities, communicate with stakeholders and restore normal operations following a significant disruption.

Scope

The plan covers:

• [Business units, sites and legal entities]
• [Critical services and customer commitments]
• [People, premises, technology, data and suppliers]
• [Relevant working hours and out-of-hours arrangements]

The plan does not cover:

• [Explicit exclusions and the document that covers them]

Activation criteria

The plan may be activated when one or more of the following applies:

• A critical activity is expected to exceed its recovery time objective.
• Staff safety or access to a required workplace is affected.
• A critical IT system, dataset or supplier is unavailable.
• Normal management or communications channels cannot operate.
• A customer, legal, regulatory or contractual commitment is at material risk.

Authority to activate: [Primary role], or [deputy role] if unavailable.
Response meeting location or bridge: [Primary and backup details].
Incident record location: [Offline-capable location or paper pack].

Initial activation checklist

1. Confirm immediate danger and contact emergency services if required.
2. Record what happened, when it began and what is currently affected.
3. Notify the plan owner or deputy.
4. Decide whether to activate this plan and record the decision.
5. Start the contact cascade.
6. Assign the response roles.
7. Confirm the next briefing time.
8. Begin the relevant recovery procedure.

Define activation in terms of business impact, not technical severity. Name a deputy with the same authority.

Continuity response roles

How to fill this section

One person may hold several roles, but name deputies and keep a reliable decision timeline for handovers, claims and review.

Emergency contacts and contact cascade

Emergency and external contacts

Staff contact cascade

Cascade message:
"This is [name] activating the [organisation] continuity contact cascade at [time and date]. [Brief confirmed facts]. Please [action]. Do not use [affected channel or system]. Confirm receipt by [method]. Your next update will be at [time] via [channel]."

If a person does not respond: [Wait period, second method and escalation route].

Keep the cascade usable without normal systems. Restrict personal data and test the process.

Business impact summary

How to fill this section

Use business-facing activity names. Set the recovery objective inside the maximum tolerable disruption and define acceptable reduced service.

If this analysis has not been completed, pause the template and use the practical UK SME continuity planning guide to identify activities, dependencies and recovery priorities. Guessing them during an incident is too late.

Recovery procedure skeleton

Create one copy of this section for each priority scenario or critical activity.

Procedure: [Scenario or activity name]

Procedure owner: [Name or role]
Deputy: [Name or role]
Activation trigger: [Observable condition]
Recovery objective: [Activity and target time]
Safety or legal constraints: [Constraints]
Required access: [Systems, premises, records and where credentials are held]

First 30 minutes

1. [Confirm the scope and record known facts.]
2. [Protect people, data, equipment or evidence.]
3. [Contact the required internal lead and supplier.]
4. [Decide whether to stop, isolate or continue affected operations.]
5. [Record decisions and time.]

First four hours

1. [Activate the minimum service or manual workaround.]
2. [Prioritise customers, cases, orders or workloads.]
3. [Confirm estimated recovery time and constraints.]
4. [Issue the approved holding message.]
5. [Schedule the next status checkpoint.]

Return to normal

1. [Confirm the restored service has been tested.]
2. [Approve transfer from workaround to normal process.]
3. [Reconcile missing, duplicate or delayed transactions.]
4. [Tell affected stakeholders normal service has resumed.]
5. [Secure records and schedule the lessons review.]

Evidence of completion: [Logs, screenshots, test results or approvals].
Escalation point: [Condition, person and contact method].

How to fill this section

Use actions with an owner and observable outcome. Link to technical runbooks and confirm supplier commitments match the objective.

For IT recovery, document the order in which identity, connectivity, core applications and data must return. The IT disaster recovery plan guide explains how to turn that order into a tested technical recovery procedure. My IT management services help SMEs align these technical dependencies with business recovery priorities and test that the procedures work.

Communications templates

Use confirmed facts and obtain legal, insurer or regulatory advice where needed.

Internal staff holding message

Subject: Service disruption - action required

"At [time] on [date], we identified [brief confirmed description]. This currently affects [people, location or service]. Please [specific instruction] and do not [unsafe or unhelpful action]. Report urgent issues to [contact] using [channel]. We will provide the next update by [time], even if there is no material change."

Customer holding message

Subject: Update about [service]

"We are currently responding to a disruption affecting [service]. Our continuity arrangements are active and our priority is [customer outcome]. At present, [confirmed impact]. Customers should [action or alternative route]. We will provide a further update by [time and date]. Please contact [channel] if your matter is urgent."

Supplier escalation message

Subject: Urgent continuity escalation - [customer reference]

"We activated our business continuity plan at [time and date] because [confirmed issue]. Your service supports [critical activity] with a recovery objective of [time]. Please confirm incident severity, current impact, actions under way, estimated restoration time and the next update point. Our response contact is [name, role and details]."

Service restored message

Subject: [Service] restored

"Normal [service] resumed at [time and date] following [brief description]. We have tested [scope] and are monitoring it closely. [State any remaining delay, customer action or reconciliation work]. We apologise for the disruption. Questions can be directed to [contact]."

How to fill this section

Pre-approve structure and tone, then insert verified facts and a next update time. Do not promise restoration without evidence.

Decision and action log

How to fill this section

Start the log with the first report. Record who decided what, the available facts and the time.

Recovery resources and manual workarounds

How to fill this section

Keep continuity resources independent of the likely failure. Minimise offline personal data and dispose of it securely after reconciliation.

Test and exercise log

How to fill this section

Use measurable objectives, track actions to closure and retest material failures.

Tailor the template to your UK SME

The core remains the same, but the detail should reflect how the organisation creates value.

Professional services firms should prioritise identity, client files, deadlines and secure remote work. Manufacturers and distributors should add site safety, production dependencies, stock records and logistics. Retail and hospitality businesses should cover payments, booking outages, cash handling and safe trading limits.

Regulated firms should record notification duties, evidence requirements and customer contacts. Cloud-first companies should focus on identity, connectivity, SaaS recovery and offline contacts. Founder-led businesses need deputies, delegated authority and accessible knowledge.

Do not add complexity merely to look mature. Add detail where it changes an action, deadline, authority or recovery dependency.

Issue, test and maintain the finished plan

The completed business continuity plan template should be short enough to navigate under pressure and detailed enough that a deputy can take over. Ask someone who did not write a procedure to walk through it. Ambiguities found in calm conditions will be worse during a real outage.

Approve version 1.0, export the offline copy and schedule the first exercise. Review contacts quarterly, the complete plan at least annually, and affected sections after significant changes or incidents.

Use the business continuity planning guide when you need to revisit the underlying analysis. Use this page when you need to turn that analysis into roles, procedures, messages and records that your team can actually follow.