An annotated business continuity plan structure

What this guide is for

This guide sets out, section by section, the structure of a business continuity plan (BCP): the operational document that says who does what to keep critical activities running during a disruption. It is written for whoever is drafting or reviewing the plan and can be used without prior training.

It assumes that the groundwork has been done, or at least started: a business impact analysis (BIA) that has identified critical activities and set their objectives, followed by a dependency analysis that has selected continuity solutions. The plan does not replace that work: it makes it usable on the day action is needed. Four terms recur throughout this guide:

• critical activity: an activity whose interruption would cause unacceptable impacts within a short time;
• maximum tolerable period of disruption (MTPD): the length of time after which impacts become unacceptable;
• recovery time objective (RTO): the target time for resumption, always shorter than the MTPD;
• minimum business continuity objective (MBCO): the reduced but acceptable level of service to be maintained during the disruption.

The principles of a usable plan

• Short. The plan will be read by someone who is anxious, interrupted, perhaps woken in the middle of the night. Anything that belongs to the method (BIA, risk assessment, justification of choices) stays in the working file.
• Action-oriented. Action verbs, one owner per action, a clear sequence. “Customer service is informed” does not say who informs them.
• Usable under pressure. Numbered lists, one-page quick-reference cards, ready-made forms: readers must be able to act without having read the whole document.
• Accessible outside the systems. A plan stored only on the intranet or in online email disappears along with them. Provide paper copies, an offline copy on key people’s phones and a copy held off site.
• Organised by impact rather than by cause. Causes are countless (fire, cyber attack, flood, strike, outage), but the losses come down to four: IT, the site, people and a supplier. One strategy per lost resource also covers the causes nobody thought of.
• Written for deputies. Write as if the main role holder were absent: they often are.

For an organisation of one or two hundred people, the body of the plan can reasonably fit into 15 to 25 pages. The appendices may be longer, since readers look up a specific piece of information rather than reading them through.

The sections of the plan, in order

For each section: what it contains, why it exists, the common mistake, a sensible length and an extract from Norvane’s plan.

Norvane is a fictitious organisation, created for the academy’s introductory course and its resources; any resemblance to an existing company is coincidental. This regional distributor of medical and hygiene consumables has 140 employees, a single warehouse and some 1,400 business customers, including 5 private clinics. Its BIA set an RTO of 24 hours for the overall order flow and of 2 hours for the clinics’ urgent orders.

1. Purpose and scope

Content. What the plan protects (products and services, critical activities), the sites concerned, exclusions and the reasons for them, the objectives adopted, and related documents such as the IT disaster recovery plan.

Why. Readers must be able to tell within a minute whether the plan applies to their situation and what has to be maintained.

Common mistake. Copying out the continuity policy or the project history; staying silent on exclusions, when what is not covered must be stated.

Sensible length. One page.

Norvane extract: this plan covers the service “delivering orders to healthcare customers” at the single site (head office and warehouse). Objectives: RTO of 24 hours for the overall flow and 2 hours for the clinics’ urgent orders. Minimum level to maintain: 100% of urgent orders and of orders from care homes for older people, at least 60% of other orders. Excluded from this version: recruitment and marketing.

2. Activation criteria and alert levels

Content. Observable criteria that trigger the plan, two or three levels, the person who decides on moving from one level to the next, and what each level sets in motion.

Why. Without a written criterion, people wait “just a little longer” for the system to come back, and use up the margin between the RTO and the MTPD. A threshold set in calm conditions removes the hesitation.

Common mistake. Vague criteria (“in the event of a serious incident”) or criteria based on cause (“in the event of fire”) rather than on effect and duration.

Sensible length. Half a page, often a table.

Norvane extract:

The one-hour threshold leaves time to switch to degraded mode before the 2-hour objective set for the clinics’ urgent orders.

3. Organisation and roles

Content. Roles, not just names: who decides, who coordinates, who runs each critical activity, who communicates, who handles IT. For each role, a main holder and at least one deputy, together with the decision-making and signing authorities that apply in degraded mode.

Why. Under pressure, the question “who decides?” wastes precious time if it has not been settled in advance.

Common mistake. A single name per role, often the chief executive’s, who is already the busiest person; or forgotten delegations, so that nobody knows who can commit to urgent spending.

Sensible length. One page, as a table.

Norvane extract:

4. Alerting and mobilisation

Content. Who can raise the alert, to whom and by what means; the call tree; fallback means if the usual telephony or email are affected; the meeting place or conference line; what is expected of the people alerted.

Why. Time lost trying to reach the right people comes straight off the recovery time.

Common mistake. A call tree that relies on the very tools affected by the incident, such as online email or internet telephony; a contact directory that has never been checked.

Sensible length. Half a page, with the directory in an appendix.

Norvane extract: anyone who notices an outage tells their manager, who calls Thomas Weber on his mobile (appendix A1). If the fibre link is cut, the warehouse’s internet telephony goes down with it: use mobile phones and plug in the backup 4G router. The crisis team meets in the Operations Manager’s office or, failing that, on the conference line listed in appendix A1.

5. The first hour

Content. A one-page quick-reference card that applies whatever the cause: make people safe, establish what has been lost, decide on the level, protect the most urgent flows, inform, open a log, set the next checkpoint.

Why. Decisions taken in the first hour shape everything that follows, yet it is the moment when least is known. A fixed list prevents omissions.

Common mistake. A card that is too detailed or tied to a single scenario; forgetting the log, which is essential for coordination, re-entry and learning lessons.

Sensible length. One page, no more.

Norvane extract, “First hour” card:

1. Make people safe if the site is affected.
2. Establish the loss (IT, site, people or supplier) and open the corresponding strategy.
3. Record the start time and open the log: time, fact, decision, author.
4. Decide on the level using the activation table.
5. List the clinics’ urgent orders in progress from the daily export kept on the offline workstation.
6. Ask Julie Moreau to inform the 5 clinics using standard message C1.
7. Explain to the picking team what to do.
8. Set the next situation update for one hour later.

6. Strategies by lost resource

Content. One strategy for each of the four losses: IT, site, people, supplier. Each says how to maintain the minimum level and within what time, which continuity solutions to activate, who activates them and with what limitations.

Why. This is the heart of the plan. Organised by lost resource, it remains valid for causes nobody foresaw.

Common mistake. Describing a solution without saying who activates it; presenting an untested solution as a given. An objective is not an actual recovery capability: the plan must be honest about the gaps that remain.

Sensible length. One to two pages per lost resource.

Norvane extract, summary of the four strategies:

• Loss of IT (ERP, WMS or fibre link): switch to picking from paper lists based on the daily export (procedure P1) and plug in the backup 4G router; Karim Haddad starts restoring the WMS with the provider. Known limitation: this restoration has not yet been tested, so its real duration is unknown.
• Loss of the site (warehouse inaccessible): no fallback site at present, a gap put to senior management for a decision. Interim measure: ask the main manufacturers and wholesalers to deliver critical items directly to the clinics and to care homes for older people.
• Loss of people: below 30 of the 34 order pickers available, reduce the flow by serving priority orders first; below 12, escalate to crisis level. WMS configuration: 2 people trained, 2 more undergoing cross-training.
• Loss of a supplier: if Altéo Transport, a fictitious subcontracted carrier handling 85% of deliveries, can no longer run its rounds, activate the framework agreement with the second carrier. For nitrile gloves in the main range, which come from a single manufacturer, draw on the buffer stock of critical items.

7. Degraded procedures

Content. Ways of working without the usual resource, written step by step: taking an order without the management system, picking without the warehouse software, delivering without the usual carrier. Forms and lists ready to print.

Why. The strategy says what to do; the degraded procedure says how. It is what allows a deputy or a temporary worker to act.

Common mistake. Procedures written without the people who use them and never tried out; forgetting how to exit degraded mode, in other words re-entry.

Sensible length. One page per procedure, numbered and dated.

Norvane extract, procedure P1 “Picking from paper lists”:

1. Print the day’s export from the offline workstation: customers, stock, orders in progress.
2. Sort the orders: clinics’ urgent orders, then care homes for older people, then other orders, up to at least 60% of the latter.
3. Pick from the list, ticking each line and noting the quantity actually picked.
4. Number and keep each list: it will be used for re-entry.

8. Internal and external communication

Content. Who communicates, with whom, through which channel and how often; the parties to inform in order of priority (staff, priority customers, other customers, suppliers, authorities where relevant); standard messages ready to adapt; the rule for approving messages.

Why. A customer who has been informed can make arrangements; a customer left without news calls, and ties up the lines you need. Staff have the same needs.

Common mistake. Drafting messages during the crisis; forgetting internal communication; letting several people speak to customers with different versions.

Sensible length. One page, with standard messages in an appendix.

Norvane extract, standard message C1 for the clinics: “Hello, this is Norvane. Our ordering system has been disrupted since [time]. Your urgent orders are still being handled as a priority: please call customer service directly on [backup number]. We will call you back at [time of next update].” Any other external message is approved by Inès Marchal or her deputy.

9. Return to normal

Content. The criteria for ending degraded mode, who confirms them and who decides; the order in which activities resume; re-entry and checking of data; informing the parties who were notified; closing the log and launching the lessons learned / post-exercise review.

Why. Recovery is a risky phase: duplicates, omissions, wrong stock figures. At Norvane, the re-entry that followed a 9-hour ERP outage took two days.

Common mistake. Declaring the end as soon as the system restarts, without checking data consistency or planning the catch-up.

Sensible length. Half a page to one page.

Norvane extract: the return to normal is decided by Thomas Weber once Karim Haddad has confirmed that the ERP and WMS are consistent. Paper lists are re-entered in number order, then checked by a second person. Customer service informs the clinics that the disruption is over. The lessons-learned review is scheduled within two weeks.

10. Keeping the plan up to date

Content. Version number, date, plan owner, distribution list (who holds a copy, in what form), review frequency, update triggers, change history.

Why. A plan goes out of date quickly: a number changes, a supplier is replaced, a team is reorganised. An out-of-date version is dangerous precisely because people trust it.

Common mistake. Reviewing the plan only once a year, with no triggers; letting several paper versions circulate without knowing which one is authoritative.

Sensible length. Half a page.

Norvane extract: version 1.1, owner Thomas Weber. Full review every year, directory checked every quarter. Update required after any change of organisation, supplier or tool, after any real incident and after every exercise. Changes in version 1.1, following a tabletop exercise on the loss of the carrier: two directory numbers corrected, signing authority for the order with the second carrier added, standard message to the clinics drafted, daily check on the date of the customer export.

11. Appendices

Content. Everything that is looked up rather than read through: internal and external crisis directory, list of priority customers with emergency contacts, inventories of applications and equipment, critical items, blank forms, emergency contracts, access maps.

Why. They keep the body of the plan light and safeguard information that would otherwise exist only in the unavailable systems.

Common mistake. Appendices that can only be consulted in the system that has failed; lists with no date and no owner.

Sensible length. No limit, provided each appendix is dated and has an owner.

Norvane extract: A1 Crisis directory (main holders, deputies, Altéo Transport, second carrier, ERP vendor, managed IT service provider, web portal agency). A2 Priority customers with emergency contacts: this list used to exist only in the ERP and is now part of the daily export. A3 Critical items and buffer stock. A4 Forms: numbered paper order form, log. A5 Standard messages.

Summary table

Checklist: is my plan usable?

• Can someone who has never read it find what they need to do within two minutes?
• Does every action have an owner identified by role, and every role a deputy?
• Are the activation criteria observable and linked to the recovery objectives?
• Is the plan organised by lost resource rather than by scenario?
• Does the “First hour” card fit on one page?
• Have the degraded procedures been tried out by the people who will apply them?
• Does the plan distinguish tested solutions from untested ones, and flag the gaps that remain?
• Are the standard messages drafted and approved?
• Can the plan and its appendices be accessed without the network, without email and off site?
• Has the directory been checked, number by number, within the last three months?
• Is the authoritative version identifiable, and have older ones been withdrawn?
• Has the plan been exercised at least once, and has the lessons-learned review led to updates?