How to Create an Airtight Business Continuity Plan in 8 Steps
Subscribe to the Nextiva blog newsletter for the latest content on Customer Service, Productivity, Marketing and VoIP.

How to Create an Airtight Business Continuity Plan in 8 Steps

If a disaster such as a fire, flood or communication breakdown were to occur, many businesses would lose profits, damage their reputation or even be forced to close. A well-thought-out business continuity plan is what you need to prevent this.

Having a company-wide plan in case of an emergency is essential. If you rely more on digital means of communication, operations and data storage can be a vulnerability.

Luckily, there are ample resources available to create a business continuity plan. Here, we’ll cover key aspects of a business continuity plan including:

Feel free to jump to a condensed version in our visual below.

making a plan

What is a Business Continuity Plan?

A business continuity plan is the outline of procedures to prevent damage, maintain productivity and recover in the event of a disaster.

When you create such a plan, identify possible threats like fires, utility disruptions or social engineering attacks. Then proactively determine what employees can do to get the business back on track.

Top 5 Threats to Business Continuity

threats to business continuity

There are several fatal disruptions a company can experience. Some businesses have industry-specific threats, but there are also events that threaten almost any company, including:

1) Natural disasters:

This includes any force of nature that poses a significant threat to human health and safety, property or critical infrastructure. Natural disasters include all natural phenomena like wildfires, tornadoes, hurricanes, winter storms, floods or earthquakes.

2) Man-made disasters

Any catastrophe that is the result of human negligence, mistake or accident. Man-made disasters include chemical explosions, gas leaks, oil spills, factory fires, hazardous material spills or improper disposal of waste.

3) Utility failures

This occurs when any utility provider fails to provide service for any reason. Utility failures include electricity or power failure, loss of communication lines or disruption of water service.

4) Intentional sabotage

These are acts you commit with the intent of putting a business at risk. Sabotage can take many forms. For example, a bomb threat, a financial information leak or arson.

5) Cybersecurity attacks/Social engineering attacks

This refers to any attack on the company’s technical assets such as by a hacker. Cybersecurity threats include information leaks, ransomware, SQL injection attacks or denial of service attacks.

the anatomy of a business continuity plan

The Anatomy of a Business Continuity Plan: 8 Key Components

In order to protect itself from profit losses, reputation damage and customer loss, a company must create a business continuity plan.

The plan should be thorough and include possible threats, readiness procedures to protect against these threats and information on who should be leading each process.

While you create this plan, be sure to thoroughly document every section so you can share it across the company later.

#1 Identify the objectives of the plan and set goals

goals, milestones and expected outcomes

Identifying the objectives of the business continuity plan and setting goals around them is step #1.

  • How detailed and practiced should the plan be?
  • What departments will the plan cover?
  • What are the outcomes of a successful plan?
  • Which milestones should we track?

One important factor is the budget for the continuity plan. Include any preparation or research hours, training time and materials, etc as you create this plan.

#2 Choose the business continuity team

assemble your business continuity plan team

An important part of your business continuity plan is the team and their responsibilities.

Include the contact information, titles and any other need-to-know information for each member. If applicable, specify backup contacts for each responsibility or department.

Two types of sub-teams to consider are:

Command and control teams

The command and control sub-teams include a crisis and recovery management team. They make sure there is near-perfect execution and that all resources are ready to go.

Task-oriented teams

This sub-team includes specialized teams such as a:

  • Public relations team
  • Damage assessment and salvage team
  • Legal team
  • Telecommunications team
  • Mechanical equipment team
  • Cybersecurity and IT team
  • Transport coordination team

#3 Conduct a business impact analysis (BIA)

business impact analysis

Impact analysis is an0ther crucial aspect of your business continuity plan. This is an assessment of the impact potential threats could have on each aspect of the business.

Predictions and forecasts can help your team put together a custom template. They have to then test it for potential holes and modify the BCP. Use this information to update the recovery plan later.

The BIA document should include explanations of the core business operations and what areas are critical for business continuity. It should document any resources needed to keep these critical departments afloat during a disaster scenario.

The BIA should detail scenarios for every level of disaster from minor disturbances to total losses. There should be options for each disaster level. This will make it easier to choose the most logical and realistic plan keeping in mind the risks.

#4 Identify key business areas and critical functions

rate business aspects by importance

As part of the BIA, the team will want to establish a comprehensive understanding of the business’s core needs. To do this, identify which critical business processes would have the most damage on the company overall. Damage can include revenue loss, harm to the company’s reputation or damage to the company’s ability to operate properly.

Examine each aspect and function of the business and classify it as either high, medium or low. Some questions that can be helpful to consider when examining critical business functions include:

  • What business objectives does this aspect support?
  • How many departments will this function affect?
  • How often does this function occur?
  • What other aspects of the business are dependent on this function for success?
  • What would be the revenue loss if this function was not completed?
  • Are there potential fines or legal issues tied in with this function?
  • Does this function impact the business’s public image or market share?

#5 Identify any pain points or dependencies

identify pain points

Also part of the BIA, businesses should proactively identify potential problems that could arise. If any departments or functions have time-sensitive stipulations, monitor the tolerable downtime. Use the rating system for key business functions to understand where to allocate resources.

Use drills and tests to make your plan fail-proof. More information on how to do that below.

#6 Make a plan to maintain operations

business continuity strategies

This should be the most detailed section of the business continuity plan. Note that you should also revisit this as the company evolves. Start by doing an analysis of current recovery capabilities and how you can improve them.

Readiness procedures could include:

Prevention strategies

Detail any actions you need to take as preventative measures before the disaster occurs.

While conducting the BIA, it’s likely you’ll find places that need mitigation. This could include having backup providers for utilities or generators available nearby. It could also include setting up alternative communication networks. Remote options for employees in emergencies is another example.

Response strategies

Each department ought to have a detailed response plan. Include exactly what each member of the business continuity team should doin case of an emergency.

For example, if there is a dangerous evacuation, procedures + safety protocols are mandatory. When and how the company will contact the media, public or customers, etc is also a part of this.

Recovery strategies

After the event has been contained, your focus should be recovery. This section should outline exactly what they are and who is responsible for implementing them. An example is a manual workaround to get the company running again. An alternative facility that the company could use in the interim is another example.

#7 Develop a testing and training curriculum

testing and training

Implement a curriculum to train the business continuity team as well as employees in the event of an emergency. This could include basic training and an overview of the business continuity plan. Or in-depth exercises designed to test the procedures and prepare employees.

An emergency protocol to train team members with specialized responsibilities is important. If you are conducting drill exercises, make sure employees display readiness and high comprehension.

Exercises should have:

  • Clear objectives and goals
  • Easily understood assumptions of the scenario
  • Instructions for all participants
  • A clear narrative
  • A post-exercise evaluation

Leaders should identify if you need further training or improvements to the overall BCP.

#8 Determine ongoing program maintenance and quality assurance

determine ongoing business continuity plan maintenance

The business continuity plan should be a living document that evolves and changes as necessary. A quality assurance strategy can ensure effectiveness as dedicated departments keep tabs on it. This could include when to hold:

Internal reviews

Businesses should conduct a review of the plan annually. This section should address exactly when updates are required due to:

  • Threats to the environment
  • Exercises that indicate the need for change
  • Changes to company structure or personnel.

External reviews

It can be helpful to have an external consultant come in and evaluate the plan or suggest improvements. This section should document when this should happen and who should conduct the audit.

Additional drills and tests

Exercise ongoing training and tests based on changes to your business continuity plan. This section can outline when that is necessary and how to conduct drills.

software and tools

Business Continuity Software and Tools

There are many tools and software you can use to craft a business continuity plan. Tools range from consultants to single task tools to full software programs. Determine which tools are right for your business by assessing your needs, plan complexity, timelines, and budget.

Preparatory tools

These include tools to help you build your BCP. For example, the U.S. Department of Homeland Security offers a Business Continuity Planning Suite. Other business continuity planning software providers include:

Internal auditing tools

These tools can help a business assess their strengths, weaknesses, pain points and areas of concern. Some handy internal auditing tools include:

Documentation tools

These can include simple office tools like Word, Excel and other office suite tools, but can also include BCM planning software.

Cloud-based software like BC in the Cloud can be helpful to document processes and also make sure they are accessible. Cloud storage software like Dropbox, Acronis and Zoolz can ensure data protection.

Communication tools

This includes internal and external communication and notification tools. Communication tools can be used to send direct messages to recovery teams, vendors, shareholders or staff.

Recovery tools

There are plenty of tools dedicated to recovery in case of business interruptions. Depending on the tool, they can help with everything from communication assistance to data recovery and office space.

  • Agility Recovery is a company that offers many of these options.
  • Novinex is another company that offers a wide range of business recovery services.
  • Data recovery tools like Long View can be helpful as well.

The Anatomy of a Business Continuity Plan [Infographic]


Having a business continuity plan is an essential security measure in today’s corporate world. The benefits are numerous both internally and externally.

Having a dynamic plan in place can help build confidence and trust with employees and shareholders. Such a plan can also help:

  • Manage the company’s reputation with customers
  • Assist the business to meet legal obligations
  • Ensure the business has minimal loss in the event of a disaster

how to make a business continuity plan

About the author

Yaniv Masjedi joined Nextiva in 2008 and currently serves as the Vice President of Marketing, focusing on marketing strategies and customer success. He graduated Summa Cum Laude from UCLA.
 

Contact an Amazing Service
Sales Expert
(800) 799-0600

See how Nextiva will transform
the way you communicate.


Contact an Amazing Service
Sales Expert
(800) 799-0600

See how Nextiva will transform
the way you communicate.