Managed IT · Template
Ten sections, each with the questions to answer and an example entry, sized for a business with 25 to 100 employees.
Ten sections with prompts
Example entries to copy
A testing routine that sticks
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
A small business continuity plan needs ten sections: purpose and scope, the continuity team, critical functions, recovery targets, dependencies, workarounds, contacts, communication, technology recovery and testing. Most 25 to 100 person companies can draft one in two or three working sessions and keep it to 10 to 15 pages.
The template below gives each section, the questions it must answer and an example entry. It follows the structure in FEMA’s Ready.gov business continuity guidance: prepare, set objectives, identify and prioritize impacts, develop strategies, define teams and tasks, and test. Copy the headings into a document, fill in the prompts and print a copy for every member of the continuity team.
Answer: which locations and teams the plan covers, what counts as a disruption, and who can activate the plan.
Example: This plan covers our main office, the warehouse and remote staff. It is activated by the CEO or, if unavailable, the operations manager, when any critical function is expected to be unavailable for more than four hours.
Answer: who leads, who handles staff, customers, IT, finance and facilities, and who backs up each person.
Answer: what the business must keep doing, ranked by how quickly its loss causes harm. Ready.gov calls this identifying and prioritizing impacts, often done as a business impact analysis.
Example: 1. Answering customer calls. 2. Taking and shipping orders. 3. Running payroll. 4. Billing and collections. 5. Marketing and reporting.
For each function note the impact of downtime after one hour, one day and one week: lost revenue, contract penalties, regulatory issues and reputation.
Answer: the maximum downtime and maximum data loss each function can tolerate. These are your recovery time objective and recovery point objective.
Example: Customer calls: back within 2 hours, no data loss. Orders: within 8 hours, no more than 1 hour of orders lost. Payroll: within 3 days. Reporting: within 2 weeks.
If you are unsure how these targets translate into IT work, our guide to business continuity vs disaster recovery explains how the two plans connect.
Answer: for each critical function, which people, systems, suppliers, equipment and locations it relies on.
Example: Order taking depends on the e-commerce site, the ERP, internet at the warehouse, two trained order clerks, the label printer and the shipping carrier’s portal.
Dependencies usually reveal single points of failure: one person who knows the process, one internet line or one supplier.
Want help filling in the technology sections? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, applications, integration, automation, AI opportunities, technology spending and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
Answer: what staff do when each dependency fails, and how long the workaround can last.
Keep these lists outside your normal systems. If email is down, a contact list stored only in email is useless.
Answer: who tells whom, how and when. Write short message templates now so nobody drafts them under stress: a staff alert, a customer notice and a supplier notice. Name the channels: text message, phone tree, website banner, social media and a voicemail update. Assign one spokesperson for customers and media.
Answer: how each system is restored, in what order and by whom. This section summarizes or links to your disaster recovery plan.
Our backup and disaster recovery guide covers backup design in detail.
Ready.gov’s exercise page explains how to turn likely scenarios into tabletop exercises and points to FEMA’s free planning exercises.
Between sessions, the plan owner fills in contact lists and tidies the wording. Aim to circulate a first version within a month, then improve it after the first test.
JLB USA includes a written recovery plan, monitored backups and tested restores in our managed IT service for businesses with roughly 25 to 100 employees. This article is general information; check insurer and contract requirements for your business.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Scope and activation, the continuity team, ranked critical functions, recovery targets, dependencies, workarounds, contact lists, a communication plan, technology recovery and a testing schedule.
For a 25 to 100 person business, usually 10 to 15 pages. It should be short enough that the team will read it and keep it current.
A business leader such as the owner, COO or office manager. IT owns the technology recovery section, but the plan covers the whole business.
Run a tabletop exercise at least once a year, test restores of critical systems at least twice a year and check contact details every quarter.
FEMA’s Ready.gov offers free business continuity guidance and advice on running exercises. The ten-section structure in this article can be copied directly into a document.
