How to Create a Small Business Continuity Plan That People Can Actually Use

Key takeaways

• A continuity plan identifies the few activities a business must restore first, the resources they need and who has authority during disruption.
• Start with a lightweight business impact analysis before buying recovery tools.
• Define maximum tolerable downtime, a realistic recovery target and a minimum acceptable service level for each critical process.
• Business continuity covers people, suppliers, facilities, communications and technology; IT disaster recovery is one part of the plan.
• Test the plan through short exercises and correct it after staffing, vendor, system or location changes.

A small business can lose access to its office, internet connection, key supplier, payment system or essential employee without warning. A business continuity plan explains how the organization will protect people, maintain its most important services and recover in a controlled order.

The plan does not need to predict every disaster. It needs to answer a smaller set of operational questions: what must continue, how long it can be unavailable, what it depends on, who decides and how the team will communicate.

Ready.gov recommends organizing a continuity team and compiling a plan to manage disruption. The U.S. Small Business Administration similarly advises businesses to document critical functions, organize a team and evaluate recovery strategies.

This guide turns that guidance into a lightweight workflow suitable for a small organization.

Business continuity is broader than disaster recovery

The terms are related but not identical.

An IT backup is important, but it cannot replace a supplier, authorize a substitute employee or explain a delay to customers. Treat disaster recovery as a component of continuity.

Step 1: Name an owner and a backup

Assign one continuity coordinator and at least one backup. The coordinator maintains the plan; the business owner or designated leader retains authority for major decisions.

For each disruption, identify:

• incident lead;
• employee-safety lead;
• technology recovery lead;
• customer and supplier communication lead;
• facilities or logistics lead;
• person authorized to approve emergency spending.

In a very small company, one person may hold several roles. Write the roles down anyway so the team knows when responsibility changes.

Do not place the only copy of the plan in an office or system that may be unavailable. Keep a protected offline or independently accessible copy, while controlling sensitive information.

Step 2: Run a lightweight business impact analysis

Ready.gov describes a business impact analysis, or BIA, as a way to predict the consequences of disruption and collect information for recovery strategies.

List the business processes that produce a customer outcome or protect a critical obligation. Examples include order intake, customer support, payroll, fulfillment, appointment scheduling, manufacturing, website operations or regulatory reporting.

For each process, capture:

• process owner;
• customers or users affected;
• normal daily volume;
• consequence after four hours, one day, three days and one week;
• legal, safety or contractual deadline;
• staff roles;
• applications and data;
• equipment and workspace;
• suppliers and utilities;
• maximum tolerable downtime;
• minimum acceptable service level.

Avoid labeling everything “critical.” If every process has the same priority, the plan cannot guide a real decision.

The MTD–RTO–MBC framework

Use three simple fields:

Maximum tolerable downtime (MTD)

The longest interruption the business can accept before the damage becomes unacceptable.

Recovery time objective (RTO)

The target time for restoring the process. It should normally be shorter than the MTD to leave a safety margin.

Minimum business capability (MBC)

The reduced service the business can operate temporarily. For example, a company may process only urgent orders, use manual appointment booking or answer priority support requests.

Example:

These targets are management choices, not technical promises. Confirm that the resources and budget can support them.

Step 3: Map dependencies and single points of failure

For every priority process, draw a simple dependency map:

Process → People → Data → Application → Device → Internet/power → Supplier → Facility

Then ask, “What single failure stops this chain?”

Common weak points include:

• one employee knows the procedure;
• one administrator controls all accounts;
• one supplier provides a custom item;
• backups use the same credentials or location as production;
• one phone number is the only customer channel;
• a payment or scheduling platform has no manual fallback;
• critical equipment has no spare or repair contact;
• remote work depends on a device kept in the office.

Score each dependency from 1 to 5 for impact and from 1 to 5 for likelihood. Multiply the scores to prioritize work:

Priority score = Impact × Likelihood

The score organizes attention. It is not a prediction of loss.

Step 4: Choose recovery strategies

A recovery strategy is the practical alternative used when the normal method fails.

People

• cross-train at least one backup for each priority task;
• document essential steps and approval limits;
• maintain current contact information;
• plan for reduced staffing and remote work;
• identify tasks that must pause rather than overloading the team.

Technology and data

• maintain tested backups appropriate to the risk;
• document application owners and vendor support contacts;
• keep recovery credentials protected and accessible to authorized backups;
• prepare a clean alternate device;
• define a manual or reduced-service process;
• record the order in which systems must return.

Ready.gov says data backup and recovery should be part of both the business continuity plan and the IT disaster recovery plan.

Facilities and utilities

• identify an alternate work location;
• define when remote work is safe and workable;
• know the electrical, internet, water and access dependencies;
• maintain emergency supplies appropriate to the workplace;
• document safe shutdown steps for equipment.

Suppliers

• identify a second source for high-impact materials or services;
• record lead times and minimum orders;
• ask vendors about their continuity arrangements;
• avoid assuming a supplier’s cloud status page covers your entire dependency;
• plan how to inform customers when a substitution changes delivery or quality.

Communications

• maintain at least two employee channels;
• prepare short customer and supplier message templates;
• assign approval authority;
• define update frequency;
• keep a public status option independent of the main website when practical.

Step 5: Write action cards, not a long essay

The full plan can contain analysis and contacts, but the first pages should be usable under pressure.

Create one action card for each priority scenario:

1. Trigger: What condition activates the card?
2. Protect: What immediate safety step comes first?
3. Decide: Who is incident lead?
4. Stabilize: What must stop or be isolated?
5. Continue: Which minimum service starts?
6. Communicate: Who needs an update and through which channel?
7. Recover: What is restored first?
8. Close: Who declares normal operation?
9. Learn: When will the after-action review occur?

Examples of scenario cards:

• internet or cloud-service outage;
• office unavailable;
• power interruption;
• ransomware or account compromise;
• key supplier failure;
• critical employee unavailable;
• severe weather;
• equipment failure.

Safety and law take priority over continuity. Do not direct employees into an unsafe workplace or instruct unqualified staff to repair hazardous equipment.

Step 6: Create a crisis communication plan

Good communication is specific, honest and limited to confirmed facts.

Prepare templates for:

• employee safety check;
• temporary service interruption;
• customer delay;
• supplier status request;
• website or social update;
• recovery confirmation.

Each message should include:

• what is known;
• what is affected;
• what the recipient should do;
• when the next update will arrive;
• a verified contact channel.

Do not speculate about cause, blame or restoration time. Security incidents may also require legal, insurance or regulatory review before public detail is released.

Step 7: Protect the plan itself

A continuity plan may contain employee phone numbers, vendor credentials, facility details and recovery procedures. Give access only to people who need it.

Maintain:

• a controlled working copy;
• a protected alternate copy;
• a printed emergency contact page where appropriate;
• a change log;
• an owner for each section;
• a review date.

Do not store passwords directly in an ordinary plan document. Reference an approved password manager or sealed emergency-access process instead.

Step 8: Test with short exercises

A plan that has never been tested is a set of assumptions.

Ready.gov offers exercises intended to familiarize team members with emergency response, business continuity and crisis communication roles. NIST contingency guidance also emphasizes training, testing and exercises.

Start with a 30-minute tabletop:

Scenario: The office has no power or internet for two working days.

Ask:

• Who declares the incident?
• How will employees receive instructions?
• Which three services must continue?
• Which systems are inaccessible?
• Can the team use alternate devices and connections securely?
• Which customers need an update?
• What decision must be made in the first hour?

Record gaps, assign owners and set due dates. Do not hide problems to make the exercise look successful.

Step 9: Maintain the plan

Review the plan after:

• staff or role changes;
• a new location;
• a critical software migration;
• a major supplier change;
• a security incident;
• a real disruption;
• a test that reveals a gap.

At minimum, verify contacts, vendors, applications, backup procedures and recovery targets on a regular schedule.

Use version control so employees can identify the current plan. Remove outdated copies that could cause confusion, while retaining required records securely.

A 30-day implementation plan

Week 1: Scope and impact

• appoint the coordinator and backup;
• list processes;
• complete the lightweight BIA;
• select five priority dependencies.

Week 2: Recovery design

• set MTD, RTO and MBC targets;
• choose people, technology, supplier and facility strategies;
• document the first three scenario cards.

Week 3: Communication and access

• build contact lists and message templates;
• protect plan access;
• confirm backups and alternate devices;
• brief employees on roles.

Week 4: Exercise and repair

• run one tabletop exercise;
• record gaps;
• assign corrective work;
• schedule the next review.

This rhythm produces a usable first version without pretending the plan is finished forever.

Common continuity-planning mistakes

Buying tools before defining priorities

Recovery technology cannot determine which business process matters most.

Treating backups as the whole plan

Backups do not cover staffing, suppliers, facilities or communication.

Creating an unrealistic RTO

A one-hour target is meaningless without systems, people and budget capable of meeting it.

Keeping the plan with the disrupted system

An inaccessible plan cannot guide recovery.

Ignoring the minimum service level

Teams need to know what “good enough for now” looks like.

Never exercising the plan

Testing exposes hidden assumptions before a real incident.

FAQ

What should a small business continuity plan include?

It should identify critical processes, recovery priorities, people and backups, dependencies, alternate methods, communication roles, contact information, safety limitations and a testing schedule.

How is business continuity different from disaster recovery?

Business continuity covers the whole operation. Disaster recovery usually focuses on restoring technology and data.

How long should the plan be?

Long enough to support the business, but the first action pages should be short and usable. Detailed inventories can sit in appendices.

How often should a continuity plan be tested?

Test after major changes and on a regular schedule. Short tabletop exercises are a practical starting point.

Can a continuity plan guarantee the business will stay open?

No. It reduces uncertainty and improves response, but some disruptions may exceed the assumptions or available resources.

Sawaira