US Business Continuity Plan Template

1. Purpose and Scope

This policy sets out the protocol for responding to serious operational disruptions at [Organisation Name] across [Location / Site(s)]. It applies whenever an incident severely threatens operations, service delivery, site safety, payroll, or contractual commitments.

This policy applies to all personnel. Store the primary copy of this plan at [Location / System] and an off-site copy at [Offsite Location / System] so it remains accessible during a facility outage.

Working through related paperwork at the same time? See also our UK Business Continuity Plan Template, Customer Service Process Template and Restaurant Staff Training SOP Template.

2. Policy Statement

[Organisation Name] prioritizes human safety, operational resilience, and legal obligations to staff, clients, vendors, and regulators during a disruption. We plan for operational risks systematically, document emergency procedures, update them regularly, and test them periodically.

3. Roles and Responsibilities

• Continuity Lead ([Role / Name]): Declares operational incidents, activates this policy, directs recovery operations, and makes final operational decisions.
• Deputy Continuity Lead ([Role / Name]): Assumes full authority of the Continuity Lead if the primary lead is absent or unavailable.
• Communications Owner ([Role / Name]): Directs all internal updates to personnel and external communications to clients, suppliers, and the media.
• IT and Data Recovery Lead ([Role / Name]): Manages system restoration, data backups, alternative IT access, and system security or data integrity assessments.
• Finance and Claims Lead ([Role / Name]): Tracks emergency spending, manages insurance claims, and files for disaster recovery assistance.
• All Personnel: Must know where to find this plan, follow official incident communication channels, and refrain from speaking to the public or posting on social media about operational incidents.

4. Risks and Scenarios

• Unusable Premises (Fire, Flood, Storm Damage, Access Denial): Move operations to backup arrangements, including [Alternative Site / Remote Work Protocol / Mobile Operations].
• Severe Local Hazards: Follow site preparation protocols and close facilities if local authority guidelines require it.
• IT System Failure or Cyber Incident: Restore systems from off-site backups and switch to manual workarounds, such as [Paper Order Forms / Secondary Payment Terminals].
• Utility Outages (Power, Water, Gas): Shut down equipment safely and close the site if essential services fail.
• Unavailability of Key Personnel: Reassign critical tasks to secondary role owners listed in the operational matrix.
• Critical Vendor Failure: Switch to pre-identified backup suppliers listed in the operational directory.

5. Critical Functions and Recovery Priorities

• Immediate Priority (Within [Number] Hours):
• Secure physical premises, inventory, and financial assets.
• Contact all personnel to confirm safety and status.
• Reroute incoming deliveries and shipments.
• Short-Term Priority (Within [Number] Days):
• Restore payment processing and point-of-sale systems.
• Resume core services, operating at reduced capacity if necessary.
• Send formal updates to key clients and primary vendors.
• Medium-Term Priority (Within [Number] Weeks):
• Return to full operational capacity.
• Repair or replace damaged equipment and facilities.
• Process insurance claims and formal assistance paperwork.
• Conduct a post-incident review.
• Critical Function Dependencies:
• Assign and document secondary deputies for all essential tasks, including payroll, purchasing, and treasury functions.

6. Plan Activation Procedure

1. Ensure human safety immediately. Initiate standard emergency protocols, including site evacuation, first aid, or calls to emergency services.
2. The Continuity Lead (or Deputy) evaluates the situation, decides whether to activate this plan, and logs the activation timestamp in the incident record.
3. Convene the incident response team via [Primary Communication Channel] to assess damage, estimated downtime, and current operating capacity.
4. Check whether personal data or restricted systems are compromised. If hit, launch the data breach response protocol immediately to meet statutory reporting deadlines.
5. Photograph all property damage. Notify the insurer ([Company / Policy Number]) and facility owner before starting non-emergency cleanup or structural repairs.
6. Carry out recovery steps by priority. Maintain a log of decisions and emergency spending, and hold daily status reviews until normal operations resume.

7. Incident Communications

• Personnel Updates: The Communications Owner sends updates via [Primary Communication Channel / Call Tree]. Messages must cover the situation overview, current work arrangements, and the scheduled time for the next update.
• Client and External Communications: Publish factual updates on facility status, delays, or alternative service channels via [Official Website / Direct Messaging / On-Site Signage]. Only designated spokespersons may speak publicly on behalf of [Organisation Name].

8. Testing, Records, and Review

• Testing Frequency: Test this plan at least [Frequency, e.g., Annually] using a scenario walkthrough exercise.
• Directory Verification: Audit emergency contact details, role assignments, and vendor directories [Frequency, e.g., Quarterly].
• Record Retention: Store exercise summaries, incident logs, and emergency financial records at [Location / System].
• Review Cycle: Review this policy [Frequency, e.g., Annually], after any plan activation or operational near-miss, and whenever key facilities, systems, staffing structures, or suppliers change.
• Document Owner: [Role / Name]
• Next Review Date: [Date]