A Business Continuity Plan Template

Business Continuity Plan Document with Some Top Threats and Scenarios to get you started.

In our previous guide on how to write a business plan, we took you step by step on how you can start on writing your business continuity plan. Here we will share a BCP Template that you can use, feel free to contact us for guidance on your Business Continuity mplementation journey.

A Business Continuity Plan (BCP) is an essential framework that prepares an organization to respond effectively to potential disruptions and disasters. The primary objective of a BCP is to ensure that critical business functions continue to operate seamlessly during and after unforeseen events, minimizing downtime and mitigating operational, financial, and reputational risks.

In today’s rapidly evolving and interconnected world, businesses face a myriad of potential threats ranging from natural disasters and cyberattacks to supply chain disruptions and pandemics. These incidents can occur without warning, making it imperative for organizations to have a robust, well-structured plan in place that addresses not only the immediate response but also the long-term recovery of essential services and operations.

The BCP is designed to be a living document, regularly updated to reflect changes in our business environment, operational structure, and emerging threats. It incorporates feedback from regular testing and exercises, ensuring that our preparedness measures remain effective and relevant.

This BCP Template will equip you with an example of a comprehensive business continuity plan (BCP).  A BCP that when layed out, outlines the procedures for your company to respond to and recover from disruptions, minimizing downtime and ensuring essential functions continue.

The Business Continuity Plan template Example

DOCUMENT MANAGEMENT INFORMATION

Document Title:	Business Continuity & Disaster Recovery Plan
Document Number:	ORGANISATION-BCDR-PLAN
Document Classification:	Internal Use Only
Document Status:	Approved

Issue Details

Release Date
Approved By

Revision Details

Version No.	Revision Date	Particulars	Approved by

Document Contact Details

Role	Name	Designation
Author
Reviewer/ Custodian
Owner

INTRODUCTION

This Business Continuity Planning (BCP) document outlines the procedures required of ORGANISATION. (Hereinafter referred as “ORGANISATION”) to ensure the continued operation of the process’s setup as part of its business needs. It also reflects the importance of processes and their ‘business continuity steps’ to ‘return to normal’. It even contains essential details of the vendors, Business Continuity teams and interdependencies if any.

These procedures are intended to reduce or eliminate negative business impact by:

• Identifying Triggers for Activation: Determine specific indicators and conditions that necessitate the activation of business continuity efforts.
• Response and Recovery Actions: Outline the steps required to respond to an incident, expedite recovery processes, and restore services efficiently.
• Continuity at Recovery Facilities: Ensure the continuity of the ORGANIZATION’S processes by planning for operations at designated recovery facilities, if available.
• Key Personnel Identification: Identify and document the key individuals involved in critical business processes and their respective roles.
• Cloud Services Downtime Mitigation: Reduce the risk of downtime for cloud services by implementing distributed instances across multiple locations.

This BCP is owned by the ORGANISATION BCM and will be reviewed annually for needed changes and ensuring the accuracy of the data and this BCP will be updated with any changes in personnel, equipment, facilities, and business processes.

SCOPE OF PLAN

The scope of this BCP is limited to the business continuity and disaster recovery procedures for ORGANISATION processes identified within this document.

This BCP covers:

• Full or Partial Destruction of the Organization’s Site: Addresses scenarios involving significant damage or complete destruction of the primary location.
• External Threats to Primary Location: Prepare for external threats that prevent staff from accessing the building, such as civil unrest or natural disasters.
• Technical Disasters: Plan for technical issues like equipment or network failures and data corruption.

Sr. No.	Site	Address
1.	Rainbow Tower	32, Rainbow tower, Muthithi Road, Westlands, Kenya

AVAILABILITY OF THE BUSINESS CONTINUITY PLAN

Approved copies of this document, sanctioned by the Business Continuity Management Committee, will be distributed to the Executive Management, process owners, and all critical personnel designated for business continuity scenarios. These copies will serve as a ready reference and support intended Business Continuity Management efforts.

PLAN ASSUMPTIONS

This BCP makes the following assumptions:

• All issues of immediate staff safety and well-being will be addressed.
• Business Continuity plan are applicable for a maximum period of 1 months post a disaster scenario.
• Staff will be available from secondary location at time of crisis.
• Important telephone numbers mentioned in this document would be reachable throughout the outage time and would act as the points of contact for their respective functions as part of the BCP.
• All departments and branches outside the affected location are fully functional and able to support recovery/continuation efforts.
• The personnel and management structure required to execute the plan are available.

Services are available from all the third-party service providers as and when required and remain unaffected.

RECOVERY OBJECTIVES 

To ensure business continuity, the organization will have critical staff resume work from the designated locations:

Primary Facility: [To Be Filled] (Imput details as per to your organisation)

Secondary Facility: [To Be Filled] (Imput details as per to your organisation)

At the [ORGANIZATION], the business continuity team, consisting of operations leaders, will be directed by the Business Continuity Manager (BCM) to organize and assist critical resources, including staff, in resuming essential services at the secondary site.

Sr. No.	Critical Process	RTO	MTPD
1.	Finance – operations	36 Hours	48 Hours
2.	Operations	1 Hour 30 Minutes	2 Hours

NON BCP/DR SITUATIONS:

To meet Business Continuity Management objectives, the following measures will be in place before an incident:

1. Power Supply Preparedness: The organization’s facility will be equipped with standby power supplies, including UPS systems and backup diesel generators with 48 hours of fuel to ensure uninterrupted power supply. The organization operates on cloud-based servers, with third-party providers responsible for fast recovery of IT infrastructure and data. Critical staff and resources will be identified for the recovery team, and their contact details will be shared with client managers.
2. Evacuation Drills: Periodic evacuation drills will be conducted by an external agency, with results shared with the organization and any relevant clients.

DURING AN INCIDENT (BCP/DR SITUATIONS):

When the Business Continuity Manager (BCM) declares and activates the BCP/DR plan, the IT support team will facilitate the necessary infrastructure for the organization’s operations through the following activities:

• Training and Security Measures: All critical resources will receive training on proper online security measures. They will be instructed to report to the secondary location or the nearest safe location during a crisis.
• Home Location Connectivity: If critical resources relocate to their home locations, VPN access will be configured to allow authorized personnel to connect securely through the internet.
• Cloud-Based Backup: The code SVN/CVS, automatically backed up on the cloud, will be available for real-time restoration.
• Production Environment Availability: The production environment, hosted on the cloud, will be immediately accessible to designated users. Cloud-based emails and intranet services will remain available.
• IT Support: The organization’s IT support team will provide additional necessary assistance as required.
• Communication of Changes: Any changes to or deviations from standard processes and procedures will be immediately communicated by the BCM.
• Coordination of Operations: If the BCP is invoked and operations transition between primary and secondary locations, restoration efforts will be coordinated and prioritized based on the criticality of each activity and process.

AFTER AN INCIDENT (BCP/DR REVOKED):

•   Restoration of Work Area: The work area and workstations at the organization’s primary location will be restored to their normal state as defined in the “Normal Situations” section.
• Communication of Resumption: Upon the revocation of the BCP and the resumption of normal operations from the primary location, the BCM or an alternate will send a formal communication to clients. This message will inform them about the restoration of services, the revocation of the BCP, and the resumption of work at the primary facility, thereby closing all BCP activities.
• Firewall Configuration: Firewall configurations will be restored to their normal settings.

PLAN ACTIVATION

The Business Continuity Plan will be activated by the organization’s Business Continuity Manager (BCM) or their alternate, in coordination with the organization’s management team and the affected business contacts.

BUILDING EVACUATION PROCEDURES

In the event of the need to evacuate the organization’s site, employees will be moved to a designated safe area. This area is designed to keep employees away from potential danger and to establish a central location for determining if all employees have been safely evacuated.

Safe Assembly Location: Next to the main security gate (at the building entrance)

The organization’s Business Continuity Team plays a crucial role in the site evacuation by performing the following duties:

• Directing Personnel: Guide all personnel at the site to the emergency exits.
• Maintaining Calm: Keep all personnel calm during the crisis.
• Steady Movement: Ensure personnel move toward the exits at a steady pace.
• Alternate Exits: Direct personnel to an alternate exit if an evacuation route is blocked.
• Area Checks: Check all areas to ensure that everyone has been evacuated.
• Head Count: Assemble personnel in the designated safe area for a head count.
• Reporting: Inform the Business Continuity Manager of any missing personnel.
• Building Security: Ensure that no one re-enters the building.
• Re-Entry Authorization: Allow personnel to re-enter the building only after receiving authorization from the Business Continuity Manager (BCM).

Tasks and Responsibilities:

• Personnel Accountability: Account for all personnel who were on-site at the time of the incident.
• Injury and Missing Reports: Report on any injuries and missing personnel.
• Transportation: Secure transportation to hospitals for the injured.
• Next of Kin Notification: Notify next of kin in the event of any casualties.

Business Continuity TOP THREATS

Threat Scenario	Availability of
	People	IT Applications	Site	Vital records	Internet	Laptop
Transmission Failure	Yes	No	Yes	may or may not	No	Yes
Act of terrorism	may or may not	may or may not	may or may not	may or may not	may or may not	may or may not
Hardware failure	Yes	No	Yes	No	may or may not	Yes
Software failure	Yes	No	Yes	Yes	Yes	Yes
Political Agitation	Yes	Yes	No	Yes	No	Yes
Electrical power supply failure	Yes	may or may not	may or may not	may or may not	may or may not	may or may not
Unavailability of vendors/suppliers	No	Yes	Yes	Yes	Yes	Yes
Flood	may or may not	may or may not	No	may or may not	No	Yes
Heavy Rains	Yes	Yes	No	Yes	No	Yes
Employee morale	No	Yes	Yes	Yes	Yes	Yes
Air conditioning failure	Yes	No	Yes	Yes	Yes	Yes
Act of Sabotage	Yes	may or may not	may or may not	may or may not	may or may not	may or may not
Mass Absence/Strikes	No	Yes	Yes	Yes	Yes	Yes
Epidemic & pandemic	No	Yes	Yes	Yes	Yes	Yes
Petroleum & oil shortage	Yes	may or may not	Yes	may or may not	may or may not	Yes

INCIDENT CLASSIFICATION

Incidents are categorized on the basis of type and impact over a period of time. BCP can be invoked in a severity zero scenario. Below is the definition of a severity zero incidents:

Severity zero Incident: a Sev 0 incident is defined as “Any natural or man-made (technical and non-technical) or ‘Legal and Regulatory’ incident leading to prolonged disruption of business operations (critical business processes), severe impact on people (injury or casualty), unavailability of IT & Technical services and sites.”

 

RESPONSIBILITY DURING A DISPRUPTION

Role	Responsibilities	Nomination
CEO	Take a decision to Invoke business continuity in conjunction with other members of Crisis Management Team (CMT).Ensure all the actions to be taken by the Crisis Management Team (CMT) are as per crisis management and Crisis communication Plan.Ensure communication related to crisis to the employees   as per defined crisis communication plan.Maintain external communication as per communication plan.	Name: Mobile: Email:
BC coordinator	Ensure all the actions to be taken as defined in the Crisis Management and Communication Plan.Participate in all the discussions undertaken by the Crisis Management Team (CMT) during and after the incident;Ensure all escalations are made to the CEO, as and when required; andCoordinate all the activities between various stakeholders during crisis.	Name: Mobile: Email:
Damage Assessment Team (DAT)	Assess the impact of the incident to the organisation and provide the status of the availability of process enablers due to the incident.Provide assessment report to the CMT	Name: Mobile: Email:
Operations Recovery Team (ORT)	Be aware of the BC plans for their own function.Follow the BC plans to recover/ restore the business operations.Ensure that the critical business processes are recovered within Recovery Time Objective (RTOs) as defined in the BC plans. Ensure critical IT applications/ telecom services are recovered in RTO values as defined in IT and Network recovery plans.Coordinate with strategic partner’s/ vendor’s teams for installation & commissioning of recovery equipment or network nodes.Communicate with the CMT and RST to deal with the business process and recovery procedures after the crisis; andReporting on progress in the process of restoration to the CMT and BC coordinator.	Name: Mobile: Email:
Recovery Support Team (RST)	Be aware of the BCM plans (BC Plan for process, Site Emergency Management Plan, Crisis Management and Communication Plan).Make available resources as per minimum operating requirements for the business function.Perform the tasks of incident recording, logging and basic coordination during crisis situation as part of crisis management.Ensure physical security for the damaged site.Coordinate the activities of moving backup media and materials and using these for recovery when needed.Act as per the instruction from CMT team and all decisions must be referred to the CMT.Coordinate with third party vendor teams or strategic partners for the requisite support.Establish, test, and recover infrastructure in the identified alternative sites; andEstablishing connectivity to the alternate sites.Provide logistic support to the employees	Name: Mobile: Email:
Head Security	Provide advice as to how best to handle incidents involving employees.Communication with the employees and their families, if required;	Name: Mobile: Email:
Legal & Regulatory (L&R) Team	Provide legal advice to CMT.Ensure the usability of any evidence collected during an investigation in the event that the organization chooses to take legal action; andProvide advice regarding liability issues in the event that an incident affects customers, partners/ vendors, and/ or general public.	Name: Mobile: Email:
Corporate communications	Tracks and manage all media communications that arise during the Crisis management.	Name: Mobile: Email:

Business Continuity Scenario

Scenario: Office premises is not accessible for operations

The Organisation’s premises may not be accessible due to the following reasons (the list is indicative):

1. Act of terrorism
2. Political Agitation
3. Flood
4. Heavy rains
5. Act of sabotage
6. Electrical power supply failure

Status of minimum operating requirements

Steps to recover the process:

Enabler Type	Enabler	Action Steps	Responsibility	Time Taken	Total RTO
Site	Insert organization’s physical address.	Facility manager to inform about the unavailability of the primary site to BC coordinator in advance (if possible) for scenarios known in advance such as Pandemic, National events, Political unrest etc.	Facility manager	2 hours	9 Hours 40 Minutes
		BC coordinator to inform about the unavailability of the primary site to Head SCM and Head BC	BC coordinator	10 mins
		Head SCM to consult the CEO and disaster to be declared. BC coordinator to be informed of the decision.	SCM director	2 hours
		BC coordinator to communicate the decision to invoke a disaster scenario to the BCWG and head security	BC coordinator	10 mins
		BCWG to inform about the unavailability of the office site to all ORT members	BCWG	1 Hour
		Head Security to inform all employees and partners working out of the office site about unavailability of office and invocation of disaster	Head security	2 hours
		ORT to resume operations from home	ORT	2 Hours
Technology	Internet	Employees are responsible to resume operations through their home internet connection/ or office provided data cards	All employees	10 mins
		All employees to connect to the IT servers to access the vital records necessary for process & IT applications using their individual login and passwords and work from home	All Employees	10 mins

Return to normal:

S. No	Action Steps	Responsibility
1	Facility manager to inform about the availability of the primary site to BC coordinator	Facility manager
2	BC coordinator to inform about the availability of the primary site to CMT & Head BC	BC coordinator
3	CMT to inform the CEO on the availability of the primary site and CEO to call off the disaster scenario. BC coordinator to be informed of the decision.	CMT & CEO
4	BC coordinator & Safety Team to inform all employees & partners of the decision (using call tree/ SMS blaster)	BC coordinator & Safety Team
5	Organization’s employees and Partner resources to resume operations from the primary site	All employees & partner resources

PLAN TESTING

An untested plan can often be more of a hindrance than a help. The effectiveness of the Business Continuity Plan (BCP) in emergency situations can only be assessed through rigorous testing under realistic conditions. The BCP Testing Phase includes crucial verification activities designed to ensure the plan can withstand most disruptive events.

Testing the BCP should occur in a realistic environment, simulating conditions that would be present during an actual emergency. It is also essential that the individuals responsible for executing these activities during a crisis are the ones conducting the tests.

PLAN MAINTENANCE

The BCP updating process must be properly structured and controlled. This includes evaluating the Disaster Recovery Plan (IT Plan) for potential changes due to the dynamic nature of threats and system configurations.

Whenever changes are made to the BCP, they must be thoroughly tested, and appropriate amendments should be incorporated into the training materials. This process should follow formalized change control procedures managed by the BCP Team Leader.

A designated form should be used for requesting and approving such changes. Once changes to the plan are approved, it is essential to keep the BCP Leader, the BCP recovery team, the Executive Sponsor, and the IRM fully informed.

INCIDENT MANAGEMENT

Incidents occurring at the organization’s primary site will be managed by the Business Continuity Team in coordination with the management team and affected client business unit contacts.

Upon completion of any incident that impacts the delivery of normal service, the BCP Team should conduct an incident analysis to evaluate the effectiveness of the BCP. This assessment aims to identify any deficiencies and ensure the plan’s adequacy.

The primary objectives of the post-incident analysis are to:

• Verify that the business recovery/resumption plans are current and up to date.
• Ensure the recovery/resumption plan performed effectively and successfully recovered the affected functions.
• Identify areas of the plan that need improvement.
• Evaluate the flow of communications during the incident.
• Assess the overall effectiveness of the plan.

Conclusion

Don’t wait for disaster to strike! Take control and build a strong Business Continuity Plan (BCP) for your organization. We’ve provided a free guide on how to write a Business continuity plan and this Business continuity plan template with a downloadable version below to jumpstart your planning process. It will guide you through identifying risks, defining critical functions, and crafting response strategies.

Ready to supercharge your preparedness? At Sentinel Africa, we’re here to help. We’ll work with you to craft a comprehensive BCP and implement a Business Continuity Management System (BCMS). Our expertise ensures your business stays operational and recovers quickly from any disruption. Contact Sentinel Africa today and secure your business’s future!

Download Below