Business Continuity Plan Template for Small Business

A business continuity plan is a written playbook for keeping your most critical operations running, or restarting them fast, when something goes wrong: a fire, flood, ransomware attack, extended power outage, supplier failure or the sudden absence of the owner. For a small business, a good plan fits in 10 to 20 pages, names who does what in the first hours and days, and protects the thing that kills most businesses after a disaster: running out of cash.

The stakes are real. A FEMA emergency management course on the effects of disasters on small businesses states that almost half (43%) of small businesses affected by a disaster never reopen, and an additional 29% close within two years. This guide gives you a business continuity plan template, walks through a risk assessment and business impact analysis, and shows a worked example for a small service firm.

What a business continuity plan includes

Section	What it covers
Purpose and scope	Which locations, services and teams the plan covers
Roles and contacts	Plan owner, deputies, staff, key clients, suppliers, insurer, bank, landlord, IT support
Risk assessment	Threats, likelihood and impact
Business impact analysis	Critical functions, maximum tolerable downtime, recovery time objectives
Recovery strategies	Alternate workspace, backups, backup suppliers, manual workarounds
Incident response steps	First hour, first day, first week checklists
Communications	Templates for staff, clients, suppliers and social media
Financial continuity	Cash reserves, credit lines, billing and collections during disruption, insurance claims
Data and IT recovery	Backups, restore process, passwords, device replacement
Testing and maintenance	Exercise schedule, review dates, version history

Step 1: risk assessment

List realistic threats and score each on likelihood and impact (1-5). Focus on the top risks rather than every possible event.

Threat	Likelihood (1-5)	Impact (1-5)	Score
Ransomware or account takeover	4	5	20
Loss of largest client	3	5	15
Owner illness (4+ weeks)	2	5	10
Office flood or fire	2	4	8
Extended power or internet outage	3	2	6

Your SWOT analysis threats list is a good starting point.

Step 2: business impact analysis

For each critical function, decide how long you can survive without it (maximum tolerable downtime) and your target to restore it (recovery time objective, or RTO). Also set a recovery point objective (RPO): how much data you can afford to lose, measured in time since the last backup.

Function	Max downtime	RTO	RPO	Dependencies
Client delivery	3 days	1 day	4 hours	Laptops, cloud apps, staff
Invoicing and collections	7 days	2 days	24 hours	Accounting data, invoice templates, email
Payroll	Next pay date	Before pay date	Last run	Payroll provider, bank access
Phones and email	1 day	4 hours	N/A	Domain, email host, mobile phones

Step 3: recovery strategies

• Data: follow the 3-2-1 approach: three copies, two different media, one offsite or in the cloud. Test restores quarterly. Keep accounting records and issued invoices backed up for at least as long as tax rules require; our guide on how long to keep invoices covers the timelines.
• People: cross-train at least one backup for every critical task and document it in standard operating procedures.
• Workspace: remote work setup, a coworking option or a reciprocal arrangement with another business.
• Suppliers: a pre-approved alternate supplier for each critical input.
• Access: a password manager with emergency access for a trusted person, and multi-factor authentication on banking and email.
• Insurance: review property, business interruption, cyber and key person cover; see our overview of small business insurance.

Step 4: protect cash flow during a disruption

Revenue often stops before costs do. Build these into the plan:

1. Emergency fund: three to six months of essential costs. See our guide to a business emergency fund.
2. Credit line arranged in advance, unused, for bridge funding.
3. Keep billing. Store invoice templates and client billing details in the cloud so you can invoice from any device. Bill for work already completed immediately after an incident.
4. Collect receivables: review your aging report and contact clients with open invoices.
5. Talk to creditors early about deferrals; landlords and lenders are more flexible when asked before a payment is missed.
6. Document losses with photos, receipts and revenue comparisons for insurance claims and any SBA disaster loan application.
7. Update your cash flow forecast weekly until stable.

Step 5: incident response checklist

First hour

• Ensure everyone is safe; call emergency services if needed.
• Plan owner declares an incident and activates the plan.
• For cyber incidents, disconnect affected devices and call IT support.

First day

• Notify staff, then key clients, using templates.
• Contact your insurer to open a claim.
• Switch to backup workspace, systems or suppliers.

First week

• Restore critical functions in RTO order.
• Send invoices for completed work; chase overdue payments.
• Hold a daily 15-minute check-in until normal operations resume.

Worked example: 8-person marketing agency

Illustrative: an agency billing about $90,000 per month has monthly essential costs of $68,000 (payroll $52,000, rent $6,500, software $3,200, insurance and loans $6,300). A ransomware attack locks the shared drive and accounting system on the 26th of the month, four days before monthly retainer invoices go out.

• Because the plan set a 24-hour RPO with nightly cloud backups, the agency restores client files and accounting data within 30 hours and loses about a day of work.
• The billing SOP lets the office manager rebuild retainer invoices from the cloud backup of last month's invoices, so $84,000 of invoices goes out on the 1st as usual instead of being delayed by two to three weeks.
• The agency's emergency fund of $150,000 (just over two months of essential costs) covers the IT recovery bill of $11,500 while waiting for its cyber insurance claim.
• Without the plan, a three-week billing delay on $84,000 at the end of the month would have forced the owner to draw on personal savings to make payroll.

Communication templates to include

In a crisis, nobody writes good emails. Draft these now and store them outside your main systems:

• Staff alert: what happened, whether to come in, how to work, who to contact, when the next update comes.
• Client notice: a brief explanation, what is affected, expected timelines, and a single point of contact. For cyber incidents, get advice before describing what data was affected.
• Supplier notice: changes to deliveries, delivery address or payment timing.
• Payment instructions confirmation: a standing message that your bank details have not changed, since criminals often exploit incidents with fake "new bank details" emails.
• Website or social post: short, factual, with how to reach you.

Plans for three common small business scenarios

Cyberattack or account takeover

Disconnect affected devices, change passwords from a clean device, call your IT provider and cyber insurer, and warn clients not to act on payment change requests. Restore from offline or immutable backups. Review your invoices and bank details for tampering, since invoice fraud often follows email compromise.

Owner or key person unavailable

A named deputy needs access to the bank, payroll, accounting system, email and client list, plus authority to sign. A power of attorney and documented SOPs make this practical. Key person insurance can fund temporary help.

Loss of the largest client or supplier

This is a financial disruption rather than a physical one, but the plan is similar: cash reserve, a pipeline of replacement clients, alternate suppliers already approved, and a cash flow forecast showing how many weeks you can cover fixed costs. If one client is more than a quarter of your revenue, treat diversifying as a continuity task.

Disaster assistance and insurance claims

After a declared disaster, the SBA offers low-interest disaster loans to eligible businesses, including economic injury loans for working capital, and FEMA and state agencies may offer other help. Terms and eligibility change by declaration, so check sba.gov when it happens. Lenders and insurers will want financial records: recent tax returns, profit and loss statements, revenue comparisons and lists of damaged assets. Keeping those records backed up offsite is part of the plan.

Who owns the plan?

Name one plan owner, usually the owner or operations manager, and one deputy. The owner keeps the document current, schedules tests and leads the response; the deputy can do all of that if the owner is unavailable.

Maintaining the plan

Put three dates on your calendar: a quarterly backup restore test, a twice-yearly contact list check and an annual tabletop exercise where the team talks through a scenario for an hour. After each, note what failed and fix it within 30 days. Store a printed copy and an offline digital copy of the plan, including contact lists and account numbers, somewhere you can reach if your office and main systems are unavailable.

Common business continuity mistakes

• Writing the plan and never testing it.
• Backups that were never restored, or that sit on the same network as the files they protect.
• Only the owner knows banking, payroll and domain logins.
• Ignoring cash: no reserve, no credit line, no plan for invoicing during the outage.
• Contact lists stored only on the office server that just went down.
• No plan for the owner's own absence.

Continuity starts with getting paid, even in a crisis. Keep a cloud copy of your invoice details and create invoices from any device with our free invoice generator, no sign-up required, downloadable as PDFs.