Most small businesses find out what their continuity plan says on the morning they need it. The internet is down and the office phones are ringing out. The list of supplier numbers is saved on the computer that won’t start.
A business continuity plan means that morning goes differently. This guide explains what goes in one, how to write it and how to test it. It spends most time on the part generic templates skip: keeping your phones, internet, Microsoft 365 and data working when the office or the systems aren’t. There’s a fill-in template near the end.
The short answer
A business continuity plan is a short document that says how your business keeps serving customers when something stops normal work. That might be a fire, a flood, a power cut, an internet fault or a cyber attack.
For a small business it can be five or six pages. It lists what matters most, how long you can manage without each thing, who does what and who to call. Most of the workarounds depend on technology, and they only help if they’re set up and tested before the day you need them.
Key takeaways
- Start with what customers would notice first. For most small businesses that’s the phones, closely followed by email.
- Set the workarounds up in advance: calls routed to mobiles, a backup internet connection and backups you’ve restored from.
- Microsoft 365 keeps a permanently deleted email for 14 days by default and a deleted SharePoint file for 93 days. Those are recycle bins, and they run out.
- Only 33% of UK businesses have a continuity plan that covers cyber security. Yet 43% identified a breach or attack in the past year (Cyber Security Breaches Survey 2025/26).
- Test the plan once a year and after any big change. A 30-minute talk-through round a table finds most of the gaps.
What is a business continuity plan?
A business continuity plan (BCP) is a written plan for keeping your business running through a disruption and getting back to normal operations afterwards. It covers people, premises, suppliers, money and technology. It won’t stop problems happening. It means the decisions are made calmly in advance, rather than by whoever picks up the phone on the day.
Writing the plan is often called business continuity planning. You’ll also see the term business continuity management. That’s the ongoing work of keeping the plan tested and up to date. ISO 22301 is the international standard for it, and larger organisations certify against it. You don’t need the standard to write a useful plan for a 10 or 50 person business.
Councils publish free templates because the Civil Contingencies Act 2004 requires them to give local businesses advice on continuity. They’re a sensible starting point. Most are written with larger organisations in mind, though, and say little about the phones, internet and Microsoft 365 that a modern office runs on. That’s the gap this guide fills.
How is a business continuity plan different from a disaster recovery plan?
A disaster recovery plan is the technical part. It covers how you restore IT systems and data after a failure. A business continuity plan is wider. It covers how you keep serving customers while that recovery happens, including staff, premises, suppliers and what you tell people.
An incident response plan is narrower again. It covers the first hours of a cyber incident: who decides, who to call and what to report. Only 25% of UK businesses have a formal one, according to the government’s Cyber Security Breaches Survey 2025/26.
A small business rarely needs three separate documents. Put the disaster recovery steps and the cyber incident steps inside the continuity plan as their own sections. Then give your IT provider a copy of those sections.
What should a small business continuity plan include?
Nine things. Each one can be a short section or a row in a table.
- Owner and date. Who looks after the plan, who deputises, and when it was last updated.
- Priorities. The business functions customers would notice first, in order.
- Recovery targets. How long each priority can stop, and how much recent work you could afford to lose.
- Risks. A short risk assessment: the disruptions most likely to affect you, from losing the office to a supplier failing.
- Workarounds. What you’ll do for each risk, set up before you need it.
- Roles. Who decides, who tells staff, who talks to customers and who calls suppliers, with a deputy for each.
- Contacts. Everyone you’d need to ring, from staff to your insurer and IT provider, with account numbers.
- Technology recovery. Your IT disaster recovery steps: a list of your hardware and software, backups, the order you’d restore systems in, and who holds admin access.
- Testing. When the plan was last tested, what you found and what changed.
The template near the end of this guide follows the same order.
How to write a business continuity plan in six steps
You can draft a first version in an afternoon. Get the two or three people who know how the business really runs into one room, and write as you go.
1. List what matters and how long you can go without it
This step is often called a business impact analysis. In plain terms, you list the business functions that keep money coming in and customers happy. Then you give each one two numbers.
The first is how long it could stop before customers or cash flow are seriously affected. That’s your recovery time objective (RTO). The second is how much recent work you could afford to lose and redo. That’s your recovery point objective (RPO). If losing a day’s invoices would be serious, backups that run once a night aren’t enough.
Be realistic about the phones. For many businesses, 30 minutes of unanswered calls does more harm than a day without the accounts system.
2. List what could stop you
Keep to the disruptions that are likely for your business. For most small offices that means:
- Losing access to the building, through fire, flood, a burst pipe or a police cordon
- A power cut
- An internet or phone line fault
- A problem with Microsoft 365, a key application or a server
- A cyber attack, often starting with a phishing email
- A key person being unavailable
- A supplier failing or going out of business
3. Decide the workaround for each, and set it up now
A workaround that has to be bought, installed or configured on the day will arrive too late. If the plan says staff will work from home, check they have laptops, can sign in without the office network and have the phone app installed. If it says calls go to mobiles, set the rule up and test it.
4. Name who does what
Give every task a named person and a deputy. Together they’re your continuity team. Someone decides the plan is in use. Someone contacts staff. Someone talks to customers, and someone deals with suppliers and your IT provider. In a small business one person may cover two of these, which is fine as long as their deputy knows it too.
5. Write down who to call
List every supplier the business depends on. Note what they provide, your account number, their fault line and their status page if they have one. Check who is named on each account as able to report faults and request changes, and add a second name while you’re there.
Keep staff personal numbers and emergency contacts in the plan too. Store them securely and share them only with the people who need them.
6. Keep a copy you can reach when the systems are down
A plan saved only on the office server or in SharePoint may be out of reach when you need it. Keep at least one copy off site that needs no network and no Microsoft 365 sign-in. A printed copy at the owner’s and deputy’s homes, plus a PDF on their phones, covers most situations.
How do you keep the phones answered when the office is down?
Phones are usually the first thing customers notice. If the main number rings out, people assume you’ve closed, and some will ring someone else.
With a cloud phone system, calls are handled by the provider’s platform rather than a box in your building. That means they can still reach your team when the office is shut. Staff answer on a mobile app or a laptop, and callers still see your business number. Our business phone systems work this way.
The routing has to be agreed before you need it. Put these decisions in the plan:
- Where calls go if nobody answers in the office. For example, a group of mobiles after 20 seconds.
- What callers hear. A short recorded message you can switch on, such as “We’re working from another location today, so calls may take a little longer to answer.”
- Who can make the change. Name them, and check they can sign in to the phone system’s portal from a mobile. If they can’t, write down who to call at your provider.
- Which staff have the app installed and have used it at least once.
If you still have an on-premise phone system or analogue lines, ask how calls would be forwarded if the building was out of action. Ask how long that takes to arrange, too. Ask your provider now rather than on the day. Ask them too what happens to your calls if their own platform has a problem, and where they post updates. Chrome customers can check our service status page.
Your numbers matter as much as your handsets. Check the business numbers are in your company’s name and could move with you if you changed provider.
Do you need a backup internet connection?
If your phones, card payments, Microsoft 365 and business applications all run over one line, a fault on that line stops them all at once. A backup connection gives the most important services another route online.
| Option | Suits | Watch out for |
|---|---|---|
| 4G or 5G backup router | Most offices with decent mobile signal. The router can switch over when the main line fails | Less capacity than the main line. Check the signal inside the building, where the router will sit |
| Second fixed line | Offices that can’t manage on reduced speed | Only helps if it reaches the building by a different route. Two lines along the same cables can fail together |
| Satellite | Rural sites where mobile signal is poor | The dish needs fitting in advance, with a clear view of the sky. Check it suits voice and video calls |
| Staff phone hotspots | One or two people for an hour or two | Not a plan for a whole office, and it uses personal data allowances |
Whichever you choose, decide which systems get the backup first. Phones and card payments usually come before large downloads and software updates. Know whether the switch is automatic or needs someone to do it, and write down who. Our 5G connectivity and satellite connectivity pages explain the options, and business internet covers the main line.
Put the router, the network switch and any phone equipment on a small battery unit, known as a UPS (uninterruptible power supply). A brief power cut then won’t restart everything and drop every call.
Is your Microsoft 365 data backed up?
Not in the way most people assume. Microsoft runs the service, but protecting against data loss is largely your job. If someone deletes, overwrites or encrypts something, the built-in tools only reach back so far:
- Email. Exchange Online keeps a permanently deleted email for 14 days by default. An administrator can raise that to 30 days, and no further.
- SharePoint and Teams files. Deleted items sit in the recycle bin for 93 days, then they’re gone.
- A leaver’s OneDrive. When a user account is deleted, their OneDrive is kept for 30 days by default.
If a deletion or a ransomware attack isn’t noticed for a few weeks, those windows may already have closed. A separate Microsoft 365 backup keeps its own copy of your Microsoft 365 data, for as long as you agree to keep it.
Laptops need thinking about too. Files saved only on a laptop’s desktop or in its Documents folder are lost if the laptop is stolen or fails. Either move those folders into OneDrive or use endpoint backup for the files that live on the device.
Then test it. Once a quarter, restore one file and one deleted email, and time how long it takes. Until you’ve restored from a backup, you don’t know it works. 24/7 monitoring can flag a failed backup job, so you hear about it before you need the data.
Finally, check who can get into the Microsoft 365 admin centre. At least two people should, both using multi-factor authentication (a second check, such as a code on your phone, when you sign in). Write down where the recovery details are kept, not the passwords themselves.
What should the cyber attack section say?
Cyber attacks are common enough to need their own section. The Cyber Security Breaches Survey 2025/26 found 43% of UK businesses identified a breach or attack in the previous 12 months. Phishing was by far the most common type, reported by 38% of businesses.
Plans haven’t kept up. Only 33% of businesses have a continuity plan that covers cyber security. Among small businesses it fell from 53% to 44% in a year. And 45% of businesses had none of the basic incident measures the survey asked about. Those include named roles and written guidance on who to notify.
Your cyber section should answer these questions before anything happens:
- Who decides to disconnect a device or suspend an account? It’s better to unplug a laptop unnecessarily than leave an infected one on the network.
- Who calls your IT provider, and on which number out of hours? Check what your support agreement covers.
- Who calls your insurer? If you have cyber cover, the policy may include a helpline and conditions about when to tell them.
- How will you talk to staff if email is compromised? Set up a group on personal phones now.
- Who reports it? A business under a live cyber attack can call Report Fraud on 0300 123 2040, 24 hours a day. It replaced Action Fraud and covers everywhere except Scotland. In Scotland, call Police Scotland on 101.
- Does it involve personal data? If a breach must be reported to the Information Commissioner’s Office (ICO), you have 72 hours from becoming aware of it.
We’ll write this section with you and check the protection behind it. See our cyber security services.
What about power cuts and the analogue switch-off?
The old copper phone line was powered from the telephone exchange. That’s why a corded phone kept working in a power cut. Digital phones, routers and cordless base stations all need mains power, so without a battery they stop when the power does.
Ofcom expects phone providers to give customers a way to reach the emergency services for at least one hour during a power cut at their premises. That’s a minimum for 999 calls. It won’t keep a business answering its customers, so plan for the UPS described above.
The analogue network is also being retired. BT Group’s final date for moving customers to digital lines is 31 January 2027, according to Openreach. Openreach says lines that haven’t moved may be put on a temporary emergency voice-only service, which may not support the features you use today.
Anything plugged into an old line needs checking, not only the phones. Common examples are:
- Intruder and fire alarm signalling to a monitoring centre
- Lift emergency phones
- Door entry systems
- Card payment terminals
- Fax and franking machines
List each device in your plan with the company that supports it, and get a written answer from each on what it needs. Our PSTN switch-off page explains how we handle the move.
How do you test a business continuity plan?
Test it at least once a year. Test it again after any big change, such as a move, a new phone system, a new IT provider or a key person leaving. In the government survey, interviewees described plans kept in a staff handbook that had never been tested. Untested plans tend to fail on small details, such as an old phone number or a login nobody has.
Two kinds of test cover most of it.
A talk-through round a table. This is often called a tabletop exercise. Put the plan in front of the people named in it and read out a scenario. For example: “It’s 8.45 on a Monday. The office has no internet and the phones are ringing out.” Walk through what each person does, and note every gap. Allow 30 to 60 minutes. The National Cyber Security Centre’s Exercise in a Box is free, needs no technical knowledge and includes ready-made cyber scenarios.
Practical checks at a quiet time.
- Unplug the main internet line and see what switches over, and what doesn’t.
- Switch on the out-of-office call routing and ring the main number from a mobile.
- Restore a file and a deleted email from backup.
- Ask someone to work for a morning from home, using only what the plan tells them.
- Ring two numbers on the supplier list and check they’re still right.
Write down what you found and what you changed, with the date. That record belongs in the plan.
Business continuity plan template
Copy this into a document and fill in the middle column. The right-hand column shows what a 12-person office might write. It covers the key components of a business continuity plan. Keep the finished plan short enough to follow on a phone.
| Section | What to write | Example for a 12-person office |
|---|---|---|
| Owner and deputy | Names, phone numbers and the date of the last update | Operations manager, deputised by the finance lead. Updated 30 September 2026 |
| Where copies are kept | At least one copy that needs no network or sign-in | Printed at both their homes, plus a PDF on both their phones |
| Priorities | What customers would notice first, in order | Answering calls, replying to email, taking card payments, invoicing, month-end payroll |
| Recovery times (RTO) | How long each priority can stop before it causes real harm | Phones 30 minutes, email 4 hours, card payments half a day, invoicing 3 days |
| Data you could lose (RPO) | How much recent work you could redo | No more than one working day of files and email |
| Loss of the office | Where people work and what they need | Staff work from home on company laptops, taking calls on the phone app |
| Phones | Where calls go if the office is down, and who switches it on | Main number rings the team’s mobiles after 20 seconds. The operations manager switches on the “working remotely” message in the portal |
| Internet | The backup connection and what it carries first | 5G backup router switches over automatically. Phones and card payments take priority |
| Power | What’s on battery, and for how long | UPS on the router, network switch and phone equipment, lasting around 30 minutes |
| Microsoft 365 and data | Backup, who to call for a restore, who holds admin access | Separate 365 backup and laptop backup. Two admins with multi-factor authentication. Restore tested each quarter |
| Cyber incident | First steps and who to call | Disconnect the device, call the IT provider, call the insurer’s helpline. Live attack: Report Fraud on 0300 123 2040 |
| Devices on phone lines | Each device, its line and who supports it | Intruder alarm: monitoring company. Lift phone: lift maintainer. Card terminal: payment provider |
| Suppliers | Name, account number, fault line, status page, who can report faults | IT and phones provider, broadband provider, insurer, landlord, bank |
| Staff contacts | Personal mobile and emergency contact, held securely | Held by the owner and deputy, checked each quarter |
| Who to tell | Which customers and suppliers get a call, and who makes it | Account managers ring the biggest customers. Everyone else gets an email |
| Testing | Date of the last test, what you found, what changed | Talk-through in March. Internet switchover tested in September |
How Chrome can help
We look after the phones, internet, Microsoft 365, backups and IT support that most of a continuity plan depends on. So we can set up the workarounds with you and test them. That means call routing to mobiles, a backup connection, 365 and laptop backup, and monitoring that flags a failed backup.
We’ll also confirm in writing what your agreement covers out of hours, before you need it. If something does go wrong, our emergency support page explains what to send us. The status page shows how the phone platform is running. If you’d rather hand day-to-day IT to one team, managed IT support covers it.
A sensible place to start
If you do one thing this week, ring your main number from a mobile while the office internet is unplugged. Do it at a quiet time. What happens next tells you most of what your plan needs to say.
Then take our free IT health check. It’s eight questions, takes about three minutes and gives you a score out of 100 across IT, cyber security and communications. If you’d rather talk it through, speak to our team on 03333 212 707 and we’ll review how your current setup would cope.
Common questions
Does a small business need a business continuity plan?
Most private small businesses aren’t legally required to have one, though some regulated sectors such as health and financial services have their own rules. Insurers, larger customers and tender questionnaires can ask whether you have one. Business interruption insurance covers lost income after an insured event such as a fire or flood. If you have it, check how long it pays out for and whether the policy asks for a plan. The practical reason matters more: a short plan written in advance saves hours of guesswork on a bad day.
What's the difference between a business continuity plan and a disaster recovery plan?
A disaster recovery plan covers restoring IT systems and data after a failure. A business continuity plan is wider. It covers keeping customers served while that happens, including staff, premises, suppliers and communication. Small businesses usually keep the disaster recovery steps as one section of the continuity plan.
What are RTO and RPO?
The recovery time objective (RTO) is how long an activity or system can be down before it causes serious harm. The recovery point objective (RPO) is how much recent data you could afford to lose, measured in time. If your RPO for invoices is one hour, a nightly backup isn’t enough.
How often should you test a business continuity plan?
At least once a year. Test again after any big change, such as moving office, changing phone system or IT provider, or a key person leaving. A 30 to 60 minute talk-through round a table finds most gaps. Add practical checks, such as restoring a file from backup and testing call routing.
Does Microsoft back up Microsoft 365?
Microsoft runs the service, but its built-in recovery tools only reach back so far. Exchange Online keeps a permanently deleted email for 14 days by default, up to a maximum of 30. SharePoint and Teams files stay in the recycle bin for 93 days. A separate Microsoft 365 backup keeps its own copy for as long as you choose.
What happens to our phones if the office loses power or internet?
Digital phones and routers need mains power, so without a battery unit they stop in a power cut. With a cloud phone system, calls can still reach staff on mobiles or laptops if the routing is set up in advance. A backup connection, such as a 4G or 5G router, can keep office phones working through a line fault.
Is there a free business continuity plan template?
Yes. The template in this guide is free to copy. Many councils publish their own, and the National Cyber Security Centre’s Exercise in a Box is a free way to test the cyber section.
Related reading
Sources and notes
- DSIT and the Home Office, Cyber Security Breaches Survey 2025/2026, 30 April 2026. 33% of businesses with a continuity plan covering cyber security (small businesses 44%, down from 53%); 43% identified a breach or attack; phishing 38%; 25% with a formal incident response plan; 45% with none of the listed incident measures.
- Microsoft Learn, Change how long permanently deleted items are kept for an Exchange Online mailbox (14 days by default, 30 maximum).
- Microsoft Support, Restore items in the recycle bin that were deleted from SharePoint or Teams (93 days).
- Microsoft Learn, OneDrive retention and deletion (30 days by default).
- Openreach, Switching off PSTN across the UK (31 January 2027; devices to check; temporary emergency voice service).
- Ofcom, Protecting access to emergency organisations when there is a power cut at the customer’s premises, guidance under General Condition A3.2(b), October 2018 (one hour minimum).
- Civil Contingencies Act 2004, section 4.
- Report Fraud, Guide to reporting cyber crime and fraud (0300 123 2040, 24 hours a day; Scotland via Police Scotland on 101).
- Information Commissioner’s Office, UK GDPR data breach reporting (72 hours).
- National Cyber Security Centre, Exercise in a Box.
