River
Y CombinatorBacked by Y Combinator
Log InStart Free

Free template

Business Continuity Plan Template

Five Word documents and five CSV sheets that map what your business depends on, set recovery times from real deadlines and plan the workarounds.

Edit with AIDownload (.docx + .csv)

Free download · No account needed

What you get

Pack of 10 files: 5 documents, 5 spreadsheets

Business Continuity Plan Template
  • Continuity StandardDocument
  • Where Recovery Targets Come FromDocument
  • Continuity PlanDocument
  • Key Person Risk NoteDocument
  • Recovery RunbookDocument
  • Single Point of Failure MapSpreadsheet
  • Critical Process RegisterSpreadsheet
  • Degraded Mode PlaybookSpreadsheet
  • Contact TreeSpreadsheet
  • Exercise LogSpreadsheet
RiverBusiness Continuity Plan Template

Critical Process Register

Bellhaven Logistics, 180 staff, two warehouses

Organizing axisUnavailability class, not scenario
Dependencies mapped14, of which 7 are single points of failure
Open gaps4, one with no date because the decision is unmade

Where each hour figure comes from

ProcessDeadline it feedsWorst momentToleranceTargetVerdict
Carrier tenderingTender cutoff 15:00, a miss rolls the load14:40 weekdays20 min15 minMet
PayrollBank cutoff, 3 working days out16:00 on the 24th90 min60 minMet
Wave release and pickingSame-day dispatch, orders before 13:0011:00 Friday2 h90 minUnmeasured
Customs entry filingFiled before the vessel dischargesFiler absent4 h4 hGap
Month-end billingCustomer portal closes, 5th working day12:00 on the 5th3 h2 hMet
Proof of deliveryUnposted PODs cannot be billed at all4th working day8 h4 hUntested
Stock accuracy reportNo hard external deadlineMonth end72 h72 hMet

The two columns that set each tolerance

Deadline it feeds is where the tolerance comes from, so the number is checkable against a contract instead of trusted. Worst moment is why payroll has ninety minutes rather than three weeks.

Stock accuracy earns a row precisely because it has no hard deadline. Seventy-two hours of slack, written down, marks it as the process not to spend money protecting.

Page 1 of 1233 words

How to write a business continuity plan

A business continuity plan (BCP) says how your most important work keeps going when something it depends on is unavailable: a system, a site, a person or a supplier. A good one lists your critical processes, what each depends on and how long each can stop before you miss a deadline that matters. It then sets out what staff do in the meantime, who can put the plan into action, how to reach everyone and when each part was last tested.

The habit that matters most: every recovery time comes from a deadline someone outside the business set, like your bank's payment cutoff.

A man talks on his phone on a busy factory floor, between stacked cardboard boxes, workstations and blue metal carts
When a system stops, the floor needs a workaround it has already practiced. Photo: Remy Gieling on Unsplash

Map what your work depends on

Many templates begin with a list of threats, from fire to cyberattack. Start with dependencies instead. Any disruption you can name, and plenty you can't, takes away one or more of four things. A ransomware attack and a vendor outage raise the same question about your order system, so they get one answer.

Four things a disruption can take away

UnavailableExamplesThe single point of failure to look for
A systemOrder software, payroll, email, phonesOne admin account, or no way to work offline
A siteAn office, a warehouse, the only cold roomWork only one location can do
A personThe only person who files customs entriesNobody else has done the job recently
A supplierYour bank, a carrier, a cloud vendorNo second source, or one never used

Build the map from records before opinions. A list of your paid tools, an org chart and an export of who holds admin rights show where work concentrates. Ask people to rate their own processes and nearly everything comes back critical.

Then count alternates honestly. An alternate has done the work recently, in earnest. A colleague who holds the certificate but last used it 3 years ago is a training need. When someone on your map resigns, their notice period is your window to hand over what they hold.

Set recovery times from real deadlines

NIST, the US standards agency, defines the two key numbers in its contingency planning guide1. Maximum tolerable downtime (MTD) is the total outage the system's owner will accept for a business process, all impacts considered. The recovery time objective (RTO) is the longest a system can stay down before the impact on the processes it supports becomes unacceptable. Because it has to keep you inside the MTD, NIST says it must normally be shorter.

Don't guess at the MTD, your tolerance for an outage. For most processes it's the time left before the first outside deadline that won't move, like a carrier's pickup cutoff or the hour a customer's invoice portal closes. Contracts, tariffs and help pages already state these, so you're looking a number up, not inventing one.

Measure from the worst moment, not the average one. Ready.gov, the federal preparedness site, notes that the point in time when a process is disrupted2 can have a significant bearing on the loss. Payroll may have weeks of slack after payday and an hour on cutoff day, so plan for cutoff day.

ExampleThree rows from a critical process registerAn illustrative example written for this guide. The company and its deadlines are made up.

Payroll. Feeds the payroll provider's cutoff, 5:00 p.m., 2 banking days before payday. Worst moment: 2:00 p.m. that day. Tolerance 3 hours, target 2 hours, estimate 45 minutes. Met.

Order picking. Feeds a contracted same-day dispatch for orders in by 1:00 p.m. Worst moment: 11:00 a.m. Friday, the busiest day. Tolerance 2 hours, target 90 minutes, estimate unknown. Unmeasured.

Stock report. No hard outside deadline, only a monthly report. Tolerance 72 hours. Met, and not worth spending money to protect.

  • Someone else's clock. Each tolerance names its outside deadline, so anyone can check it.
  • Unmeasured is worse than a gap. A gap has a number to argue with. Unmeasured has none.

Plan what runs while you wait

Restoring a system ends an outage, and that job belongs in the IT team's disaster recovery plan. The continuity plan covers what staff do during the outage, often the only part you control when a vendor runs the system.

For health care organizations, HIPAA's Security Rule3 makes the same split. It requires a disaster recovery plan to restore lost data and, separately, an emergency mode operation plan for continuing the critical business processes that protect patient data.

Each workaround entry records five things.

  • What runs instead, and who runs it
  • How long it holds
  • What piles up meanwhile
  • What to reconcile afterward
  • When it was last run against the clock

Some workarounds exist only if you set them up in advance. IRS Publication 15 says EFTPS, the US Treasury's tax payment system, accepts same-day deposits4 of up to $1 million submitted before 3:00 p.m. Eastern time on a business day. Miss that cutoff and a same-day wire through the Federal Tax Collection Service can still be on time, if you arranged it with your bank beforehand.

Write down what you can't do yet

Where no workaround exists, write "none" rather than inventing one. Where the honest estimate is longer than the target, record the gap with an owner and a date. If the deadline behind it can't move, NIST's guide says to document the situation and plan its mitigation.

Decide who declares and how to reach everyone

Name who can declare a disruption, which puts the plan into action. Then pick a deputy who takes over if that person can't be reached within a set time, such as 30 minutes. Say what each may spend without asking. Declare when a process is about to run past its tolerance, not once someone has confirmed what broke.

The contact tree has to work with every company system down. NIST's guide says a call tree should cover primary and alternate contact methods1 and what to do when someone can't be reached. Print personal mobiles and vendor account numbers on a card. An account number stored in the system that's down is no help.

Keep separate lists for staff and customers. FINRA, which regulates US broker-dealers, lists alternate communications with customers and with employees5 as separate items in the plan it requires. It even makes a one-person firm name a second emergency contact, such as its lawyer or accountant. Give your tree a branch outside the company, and leave public statements to a crisis communication plan.

Test the business continuity plan

A plan nobody has run is a list of assumptions. Ready.gov describes tabletop exercises6 as discussion-based sessions and notes that many can be run in a few hours. Start with a tabletop, then run the tightest workarounds for real.

  1. Pick one dependency

    Choose the row with the tightest tolerance whose workaround has never been run.

  2. Set the clock and a stop rule

    Agree on the target, a time limit and when you'll stop to protect customers.

  3. Make it unavailable

    Lock the account or close the portal, unannounced where safe, and let the real team work from the plan.

  4. Write up what broke

    Log target against actual and what nobody predicted, then fix it and test again.

Review the plan at least once a year and after any big change. FINRA makes member firms do both: an annual review and an update after any material change5. NIST adds that contact lists need checking more often.

If a regulator or contract requires a plan

In the US, broker-dealers must meet FINRA Rule 4370, and HIPAA covered entities and business associates must meet 45 CFR 164.308(a)(7). Contracts and insurers can add terms. Have your compliance lead or lawyer check the plan, because this guide is not legal advice.

Before you sign it off

  • Each critical process lists everything it depends on
  • Every alternate has done the work recently
  • Each recovery target names the outside deadline behind it
  • Each workaround says how long it holds and what to reconcile
  • Every gap has an owner and a date, or says why not
  • At least one contact is outside the company and reachable with systems down

The template at the top of this page includes a filled example plan and the five sheets described here. With Edit with AI, River drafts your dependency map from a tool list and an org chart, then asks for your deadlines.

How to use this template

Use the five Word documents and five CSV sheets as they are, or open them in River. Send River a list of the tools you pay for and who does what, plus an export of who holds admin rights if you have one. It maps every dependency and flags the ones with a single person, account, site or supplier behind them.

Then River lists the processes that matter most and asks what only you know: the first hard outside deadline each one feeds, and its time of day. From your answers it sets each tolerance and target, fills in the workarounds and contact tree, and asks which gap to work on first. Where there's no deadline or no workaround, it says so instead of guessing.

  1. Download it or open it in River

    Get the five Word documents and five CSV sheets free, or open the template in River to work with AI.

  2. Map what each process depends on

    Fill in the Single Point of Failure Map yourself, or send River your tool list and org chart to draft it.

  3. Set targets from real deadlines

    For each critical process, note the outside deadline it feeds and the time left at the worst moment, then set the target within it.

  4. Test one dependency at a time

    Make one dependency unavailable, run the workaround against the clock and log what broke in the Exercise Log.

What's in the template

Fourteen dependencies, seven single points, four honest gapsCriticality is a property of dependencies rather than of processes, so the map is built before the register and not after it.
Business Continuity Plan Template
RiverDependency Map

Single Point of Failure Map

Illustrative rows for a fictional third-party logistics business, Bellhaven Logistics. One row per dependency, never per process.

DependencyClassAlternatesHas performed itVerdictGap closes
Warehouse management systemSystem0n/aSingle point14 Dec
EDI mapping for the 4 largest customersPerson0n/aSingle point14 Dec
Customs entry filingPerson1No, not in 3 yearsSingle point31 Jan
Tilbury site powerSite0n/aSingle pointno date set
Temperature logger platformSupplier1NoAlternate untested20 Dec
ACH payment file submissionPerson1YesPair requiredclosed
Yard slot booking systemSystem1YesAlternate provenclosed
Night shift supervisor, WakefieldPerson2Yes, both this yearCoveredclosed

The customs filer is the row that justifies two columns instead of one. A second person holds the certificate, so an alternate count alone shows this dependency as covered. They have not filed an entry in three years. What they hold is a credential rather than a competence, and only a competence files correctly under time pressure.

The EDI mapping came out of the map, not out of an interview. Nothing in an org chart records that exactly one person can read the orders from your four largest customers. A system with one operator is a countable fact, available from an admin export without asking anybody.

Tilbury site power carries no date. The capital decision has not been made, and writing a plausible date there would make every real date on the sheet unverifiable.

RiverDegraded Mode

Degraded Mode Playbook

Not how to restore the system. What the business does while it is still down.

ProcessWhat runs insteadHolds forWhat accumulatesRehearsed
Carrier tenderingEmail tenders against the standing rate cardIndefinitelyNothing, the email tender is equivalent4 Nov
Goods receiptWhiteboard slot board at the gateTwo daysBooking history and detention evidence18 Sep
Month-end billingBill from the warehouse extract directlyOne cycleLedger postings, credit control notes6 Oct
Wave release and pickingPrinted pick list from the last stock extractOne shiftStock movements, paper confirmationsnever
Proof of deliveryPaper POD signed and photographedOne weekUnposted PODs, so nothing can be billednever
Temperature recordsHourly manual readings signed at the bayWhile staffing allowsNothing if the round is keptnever
Chilled handlingNo degraded mode existsn/aRefused loads, customer notificationsnever
EDI order intakeNo degraded mode existsn/aEvery order received during the outagenever

Holds for is the column that gets left out and it is usually the most important thing on the row. Picking from a printed list works for exactly one shift, because after that the stock extract is too stale to pick against safely. A playbook without that column reads as though the workaround is a substitute.

Two rows say no degraded mode exists, and that is the honest answer. Inventing a workaround for the chilled bay would make the plan read as complete while the site refuses loads at the gate. Both rows appear again in the gap list, which is the pattern to expect.

Carrier tendering degrades cleanly because the workaround was the real process until 2023. An older process the company already ran is the strongest evidence a fallback works.

RiverExercise Log

Exercise Log

One dependency made unavailable, against the clock. Never a simulated disaster.

DateMade unavailableTold in advanceTargetActualWhat broke that nobody predicted
4 NovCarrier tendering portalNo15 min10 min2 of 11 carriers reject email tenders
6 OctFinance systemYes2 h90 minNobody in finance held a warehouse license seat
18 SepYard slot booking systemYes60 min30 minThe whiteboard was locked in an absent supervisor's office
12 AugThe certified customs filerNo4 h3 h 40The broker retainer had lapsed in March
22 JulOne ACH signatoryYes60 min45 minThe emergency mandate needs renewing after use
19 FebWarehouse management systemYes90 minAborted at 4 hThe last stock extract was 31 hours old
not yetTilbury site powern/a2 hNever testedCannot be exercised without a generator
not yetEDI mappingn/a45 minNever testedCannot be exercised until the maps are written

The February abort is the most useful row here. It did not fail because the system was slow to come back. It failed because the degraded mode needed a stock position, and the newest one was thirty-one hours old. The workaround was documented, approved, and unusable, and no amount of reading the plan would have found that.

The last column is the actual output. The measured duration confirms a number you already had. What broke that nobody predicted tells you something you did not know. It is never in the step the plan describes: a locked office, a lapsed retainer, a missing license seat.

Two of the six completed exercises shown were unannounced. An announced exercise measures the plan; an unannounced one measures whether anybody can find it.

RiverContact Tree

Contact Tree

Every row carries a channel that works with no company system running.

RoleOut-of-band channelInside the companyAuthorityVerified
Declare a disruptionPersonal mobile, printed card at both gatesYesActivates the plan, authorizes spend to 250003 Nov
Deputy declaring authorityPersonal mobile on the printed cardYesSame authority after 30 minutes unreachable3 Nov
Second contact outside the companyRetained broker out-of-hours numberNoFiles customs entries under their own certificate14 Oct
Warehouse system vendorEscalation number and account number on the cardNoNone, escalation only14 Oct
Staff notificationSMS list exported monthly to both gate PCsYesNone, receive only3 Nov
Customer notificationMobile numbers in the printed customer packYesCommits a revised dispatch time3 Nov
Bank relationship managerBranch switchboard on the cardNoConfirms whether a submitted file clearedunverified
Chilled bay escalationSite engineer's personal mobile on the cardPartlyRefuses or diverts loads at the gateunverified

The vendor account number is on a printed card for one reason. It is stored inside the system you need to call about. That is one way an emergency contact list fails: everything on it is correct and none of it is reachable.

Staff and customer notification are two trees, not one directory. They fail differently. Staff email and internal chat usually go down together, so the fallback is a phone list. It is exported on a schedule, because a stale list is indistinguishable from no list at all.

Verified is a date on which the out-of-band channel was actually used. Two rows say unverified, which is a number nobody has dialed rather than a number nobody has checked.

  • Continuity StandardThe four rules behind the plan, including organizing by what is unavailable and deriving every recovery target.
  • Where Recovery Targets Come FromTolerance versus target, seven kinds of hard deadline to look for, and what to do when estimates fall short.
  • Continuity PlanA filled plan for a made-up logistics company: who declares, critical processes, workarounds, communications, gaps and exercises.
  • Key Person Risk NotePerson risks split by failure mode (unplanned absence, resignation, sudden loss), with four worked examples ranked by exposure.
  • Recovery RunbookOne filled runbook for a warehouse system outage: the first 10 minutes, the workaround and what to reconcile afterward.
  • Single Point of Failure Map sheetEvery dependency with its class, qualified alternates and whether an alternate has actually done the work.
  • Critical Process Register sheetEach process with its deadline, worst moment, tolerance, target, honest estimate and verdict.
  • Degraded Mode Playbook sheetWhat runs while something is down, who runs it, how long it holds and what to reconcile.
  • Contact Tree sheetEach role's backup channel that works without company systems, its authority and when it was last checked.
  • Exercise Log sheetEach test: what was made unavailable, target against actual, and what broke that nobody predicted.

Common questions

What should a business continuity plan include?

A business continuity plan should list your critical processes, what each depends on and a recovery time for each, traced to a real deadline. It should also say what staff do while a process is down, who can declare a disruption, and how to reach people with your systems offline. It ends with the open gaps, their owners and your latest test results.

What is the difference between a business continuity plan and a disaster recovery plan?

A business continuity plan keeps the business running while something is unavailable, and a disaster recovery plan restores the IT systems and data. Continuity also covers people, sites and suppliers, plus the workarounds staff use during an outage. The two should agree, because system recovery times have to fit inside the business's deadlines.

How do you set a recovery time objective?

Set a recovery time objective by working back from a real deadline, not from the system. Find the first hard outside deadline the process feeds, such as a bank or carrier cutoff, and measure the time to it from the worst moment in the week. Keep the objective inside that window, in hours, with the deadline written beside it.

How often should you test a business continuity plan?

Test the workarounds for your most critical processes at least once a year, and the ones with the tightest deadlines more often. Review the whole plan yearly and after any major change to systems, sites, staff or suppliers. Check the contact list more often still, because people change numbers and roles.

Does a small business need a business continuity plan?

Yes, if a missed payroll run, customer deadline or tax deposit would hurt. A small business often has more single points of failure, since one person may hold a whole process. Some firms are required to have one, such as US broker-dealers under FINRA Rule 4370, and large customers may ask for one in vendor reviews.

Is this business continuity plan template free?

Yes. Download the five Word documents and five CSV sheets with no signup. Most files are filled in for a made-up logistics company, so you can see a finished plan before adding your own details. Edit with AI opens the same template in River.

What does Edit with AI do?

It opens the template in a free River workspace. Send a list of your tools and who does what, and River builds the dependency map, marking each single point of failure. Next it asks what outside deadline each key process feeds, sets targets from your answers, fills in the workarounds and contact tree, and asks which gap to tackle first.

Sources

  1. NIST. “NIST 800-34, Rev 1 Contingency Planning Guide for Federal Information Systems.” nvlpubs.nist.gov (opens in a new tab)

  2. Ready.gov. “Business Impact Analysis.” ready.gov (opens in a new tab)

  3. eCFR. “45 CFR 164.308 — Administrative safeguards.” ecfr.gov (opens in a new tab)

  4. IRS. “Publication 15 (2026), (Circular E), Employer’s Tax Guide.” irs.gov (opens in a new tab)

  5. FINRA. “4370. Business Continuity Plans and Emergency Contact Information.” finra.org (opens in a new tab)

  6. Ready.gov. “Exercises.” ready.gov (opens in a new tab)

Written by

Chandler Supple

Co-founder & CEO, River

Chandler has spent the last six years working in AI, building tools for millions of users and Fortune 100 companies. In 2025, he co-founded River to build a new kind of operating system for AI agents.

LinkedInGitHubX

Reviewed by

Brian Joseff, Co-founder, River

LinkedInX

Related tools and templates

More free templates