In short
A business continuity plan brings the company back to a pre-defined level of operation after a disruption: it covers people, premises, suppliers and communication, not just IT.
The business impact analysis identifies prioritized activities and sets MTPD, RTO and RPO: the RTO must always be shorter than the maximum tolerable period of disruption.
Strategies are chosen by resource category and are worthwhile only if they get you restarted within the RTO at a sustainable cost.
The plan must say who decides and who does what in the first hour, with clear activation criteria and template messages ready to use.
A plan that has never been tested is a hypothesis: tabletop exercises and restore tests turn it into a tool that works, and ISO 22301 keeps it alive over time.
How long can you afford to stand still? The BIA gives you the answer; the plan tells you what to do in the first hour. A business continuity plan exists for exactly this: to turn a sudden disruption (a ransomware attack, a flooded warehouse, a supplier that shuts down overnight) into a sequence of decisions already taken, instead of an emergency meeting where everyone talks and nobody decides.
Many SMEs think business continuity is something for banks and large groups. In reality, it is the small company that suffers most when it stops: fewer redundancies, fewer people who know the processes, customers who will not wait. In this guide we look at what a continuity plan is and what it is not, how to carry out a business impact analysis, how to choose strategies, what the plan must contain for the first hour of a crisis and how to put it to the test with an exercise. We close with its relationship to ISO 22301, the international standard for business continuity management systems, and with the mistakes we see most often.
What is a business continuity plan, and what is it not?
A business continuity plan is the set of documented procedures that guide you to respond, recover and resume activities after a disruption. The definition used by the ISO family of continuity standards refers to procedures that bring the organization back to a pre-defined level of operation: not "everything as before" straight away, but the agreed minimum, within the agreed time.
The key word is "pre-defined". The plan does not improvise: it starts from decisions taken in calm conditions about which activities to restart first, with which resources and how quickly. That is why a good plan is short, practical and tied to precise figures that come from the impact analysis.
Business continuity and disaster recovery are not the same thing
Disaster recovery is about restoring IT systems: servers, applications, data, backups. Business continuity covers the whole company: people, premises, suppliers, customers and communication, as well as IT. Disaster recovery is therefore one part of the continuity plan, often the most technical, but it is not the whole of it.
An example makes the difference clear. If ransomware encrypts your ERP, the disaster recovery plan says how to restore the data from backup. The continuity plan also says who informs customers with deliveries under way, how urgent orders keep being fulfilled in the meantime, who talks to the insurer and who decides whether to stop production.
Nor is it the emergency plan
The emergency and evacuation plan required by health and safety legislation protects people at the moment of the event: fire, earthquake, gas leak. The continuity plan starts once people are safe and the question becomes: how do we get back to work? The two documents must be consistent (who coordinates, where people gather, how they communicate), but they have different aims and one does not replace the other.
Why does an SME need a continuity plan too?
An SME needs a continuity plan because it has less room to absorb a shutdown. A large company has several sites, several suppliers and more people able to stand in for each other; an SME often has a single warehouse, a single ERP and a single person who knows how e-invoicing works.
A typical scenario
Picture a components manufacturer with 60 employees and a major automotive customer that receives deliveries every day. On a Monday morning the ERP will not start: ransomware has encrypted the server. Without a plan, the day goes like this: the IT manager tries to work out what has happened, the owner calls the IT supplier, production stops because it has no bills of materials, and sales discover mid-afternoon that the customer was expecting a lorry at 2 pm.
With a plan, the same morning has a different rhythm. The person on duty activates the crisis team within half an hour, the IT manager isolates the systems and starts recovery following a procedure already written, production works on priority orders using bills of materials printed or saved offline, and sales inform customers with a message prepared in advance. The shutdown still happens, but it is shorter and, above all, it does not turn into a loss of trust.
Who asks for it: customers, insurers, regulations
More and more often, a continuity plan is not just an internal choice. Large customers ask for it in supplier qualification questionnaires, together with questions on backups and information security. Cyber insurers also tend to assess how the company reacts to an incident.
For companies within the scope of the NIS2 Directive, continuity is an explicit obligation. Article 21 of Directive (EU) 2022/2555 lists among the minimum risk-management measures business continuity, such as backup management and disaster recovery, and crisis management. If you want to understand whether your company is affected, start from our page on the NIS2 Directive.
How do you carry out a business impact analysis (BIA)?
A business impact analysis is the process through which you analyse the company's activities and the effect a disruption would have on them over time. It is the foundation of the whole plan: without a BIA, recovery priorities are opinions; with a BIA, they become reasoned decisions. ISO does not impose a single method, but it devotes a technical specification of guidelines to the BIA, ISO/TS 22317, designed to be adapted to organizations of every type and size.
Identify your prioritized activities
The first step is to list the products and services you deliver to customers and trace back the activities that make them possible: order intake, planning, production, shipping, support, invoicing, payroll. For each one, ask what happens if it stops for an hour, a day, three days, a week. The impacts to consider are not only financial: penalties and contractual obligations, reputational damage, sanctions and safety issues all count.
The result is a ranking. The truly priority activities are usually few: in a manufacturing SME they might be production for customers with daily deliveries, shipping and payroll. Many others can wait a few days.
MTPD, RTO and RPO: the three figures that matter
For each prioritized activity the BIA sets certain times. The ISO vocabulary for the security and resilience series defines them precisely, and it pays to use them because they are the same ones an auditor or a customer expects to find.
Parameter | What it measures | Question to ask yourself |
|---|---|---|
MTPD (maximum tolerable period of disruption) | The time after which the impacts of the shutdown become unacceptable | After how long does the damage become unbearable? |
RTO (recovery time objective) | The time within which the activity or resource must restart after the incident | How quickly must I be operational again? |
RPO (recovery point objective) | The point to which information must be restored for the activity to restart | How much data can I afford to lose? |
The rule to remember is that the RTO must be shorter than the MTPD: you need to restart before the damage becomes intolerable, with a margin. The RPO, on the other hand, drives backup frequency: if the last usable backup is from last night and your RPO is one hour, the problem is not the plan, it is the backup.
The resources each activity depends on
The last step of the BIA is to understand what each prioritized activity needs in order to work: people with specific skills, premises, machinery, applications, data, suppliers, external services such as connectivity and energy. This is where single points of failure emerge: the only technician who can reprogram a machine, the only supplier of a component, the cloud ERP with no alternative. Each of these points becomes a direct input to the risk assessment and to the strategies.
From BIA to strategies: how do you choose what to do?
After the BIA you know what to protect and how quickly to restart; the strategies tell you how. Before choosing them, however, you need a risk assessment that tells you which disruptions are most likely and which resources are most exposed.
Assessing disruption risks
The risk assessment cross-references the critical resources identified by the BIA with the threats that could affect them: breakdowns, cyber attacks, natural events, staff unavailability, problems at a supplier. You do not need an endless catalogue of scenarios. You need to focus on the events that would hit prioritized activities and ask, for each one, whether current measures are enough. If you already have an ISO management system, you can reuse the logic you know from managing risks and opportunities, applying it to the availability of activities rather than to product quality.
Strategies for people, premises, technology and suppliers
Continuity strategies are built by resource category and must meet the times set by the BIA. Some typical examples for an SME:
People: cross-training at least two people for each critical skill, written instructions for rare operations, an up-to-date contact list.
Premises: the option of remote working for office staff, agreements with another site or a partner for activities that need physical space.
Technology: backups with at least one copy isolated from the network and a tested restore, emergency access, paper or offline forms for essential activities.
Suppliers: qualified alternative suppliers for critical materials, safety stock, contractual clauses on continuity.
For suppliers, ISO has also published guidelines dedicated to supply chain continuity, ISO/TS 22318. The selection criterion is always the same: a strategy is worthwhile if it gets you restarted within the RTO at a sustainable cost.
What must the plan contain for the first hour?
The continuity plan must say who decides, who does what and how communication works in the first moments of the incident. The first hour is when most time is lost, because nobody knows whether the event is serious enough to activate the plan and who has the authority to do so.
Response structure, roles and activation
The heart of the plan is the response structure: a small crisis team with a leader, a deputy and contacts for IT, production or service, communication and staff relations. Each role needs a name, a deputy and contact details that work even if company email is down. The plan must also set out the activation criteria: for example, an expected shutdown longer than the RTO of a prioritized activity, the premises being unavailable, or a cyber incident involving customer data.
Internal and external communication
During a disruption, communication is often the second incident. The plan must set out who speaks to employees, customers, suppliers, the insurer and, where required, the authorities. It is worth preparing short, truthful template messages in advance, to be adapted at the time. If you fall under NIS2 or process personal data, the plan must link to the incident notification procedures, which have their own deadlines.
The first-hour checklist
Here is an essential sequence you can adapt to your company:
Make people safe and, if needed, activate the emergency plan.
Quickly assess the event and decide whether to activate the continuity plan.
Convene the crisis team on an alternative channel agreed in advance.
Contain the damage: isolate affected systems, hold shipments at risk.
Start recovery procedures for prioritized activities in the order set by the BIA.
Inform employees and key customers using the template messages.
Record decisions and times in a crisis log, useful for recovery and for the review afterwards.
The plan should not be a manual: it should fit into a few operational sheets, one per scenario or per activity, accessible offline and known to the people who will have to use them.
How do you check that the plan really works?
A plan that has never been tested is a hypothesis. The only way to know whether it works is to exercise it regularly, starting with simple tests and increasing complexity over time. ISO 22301 makes exercises a structural part of the system: it requires procedures to be tested and the results used to improve them.
Three levels of exercise
The simplest level is the tabletop review: the crisis team sits around a table and walks through a scenario step by step, checking that roles, contacts and procedures are clear. Next comes the scenario simulation, in which someone introduces surprises during the test: the leader does not answer, the backup is older than expected, a customer calls live. The third level is the technical test: actually restoring a system from backup and measuring the real time against the RTO.
For an SME, a realistic cycle includes at least one tabletop exercise and one restore test each year, plus a test after every major change: a new ERP, new premises, a new critical supplier. You decide the right frequency yourself, based on the risks, and justify it.
After the test: correct and update
Every exercise should produce a short report: what worked, what did not, which actions are needed, who carries them out and by when. This is where the plan really improves. Typical errors surface immediately: out-of-date contacts, emergency passwords nobody can find, procedures that assume a system that is not available. Treat them as genuine corrective actions, with an owner and a deadline, and check at the next test that they have been closed.
Continuity plan and ISO 22301: when does certification make sense?
You can have a good continuity plan without being certified. ISO 22301 is useful when you want a management system that keeps the plan alive over time, and when you want to demonstrate it to third parties with a certificate issued by an accredited body.
From plan to management system
ISO 22301 specifies the requirements to plan, implement, monitor and improve a business continuity management system. It follows the structure common to all ISO management system standards (context, leadership, planning, support, operation, performance evaluation, improvement), which you will find explained in the guide on what ISO certifications are. In its operational part the standard requires exactly what you have read so far: BIA, risk assessment, strategies, plans and procedures, an exercise programme. The difference from a plan left in a drawer is that the system requires you to review and improve regularly.
The standard is designed for organizations of every type and size, and ISO also publishes application guidance, ISO 22313. Like all ISO standards, it is reviewed periodically: before starting, check the current edition and any amendments on the standard's official page.
How it integrates with ISO 27001 and other systems
If you already have an ISO 27001 system, part of the work is done: the information security standard includes controls on the continuity of information systems, backups and incident management. ISO 22301 widens the view to all activities, not just IT ones. For many SMEs the most efficient solution is an integrated system that shares internal audits, management review and document control. You will find the information security picture in our complete guide to ISO 27001 and a technical starting point in the article on minimum cybersecurity measures for SMEs.
What Complaion does in an ISO 22301 project
In a project with Complaion, a dedicated Lead Auditor follows the company from the BIA to the certification audit: helping to set realistic RTOs and RPOs, choose proportionate strategies and write procedures people will actually use. The platform collects the evidence (exercise reports, backup checks, crisis team minutes), manages documents with up-to-date versions and keeps the schedule of tests, reviews and audits. So when the certification body arrives, the audit is prepared and the evidence is already in order. You will find the details of the service on the page dedicated to ISO 22301 certification.
What are the most common mistakes?
The most frequent mistake is writing the plan without having done the BIA. The result is a document that says "restore systems as soon as possible" without saying which ones, in what order and how quickly: unusable under pressure.
The second mistake is leaving everything to IT. Restoring servers is essential, but if nobody has thought about how to inform customers, who can sign off an urgent order or where people work if the premises are unusable, the shutdown lasts longer anyway. Continuity is a responsibility of top management, which must approve priorities and provide resources.
The third mistake is taking backups for granted. Many companies discover during the incident that the backup was incomplete, encrypted along with the data or never test-restored. A backup is only worth something if you have verified the restore within the times required by the RPO and RTO.
The fourth mistake is not updating the plan. People changing roles, phone numbers, new suppliers, new applications: within a year an unmaintained plan loses much of its value. Link updates to specific events (new hires, supplier changes, new systems) and to a periodic review, and keep the plan available outside the systems that might go down.
How Complaion makes the journey simpler
An effective continuity plan comes from a well-run BIA, proportionate strategies and regular exercises, and it stays useful only if someone keeps it up to date. Complaion helps you do all three without weighing the company down. We start from your needs and propose the route that suits you best: a solid continuity plan, a system integrated with ISO 27001 or full ISO 22301 certification. A dedicated Lead Auditor follows you at every stage, while the platform collects the evidence, manages documents, keeps the schedule of tests and reviews and prepares the audit with the certification body. It is the method with which we have already supported more than 1,000 clients. The cost depends on size, number of sites, process complexity and starting point: contact us for an initial analysis and a tailored quote.
Frequently asked questions about business continuity plans
What is a business continuity plan, in simple terms?
It is an operational document that says how your company keeps working, or restarts, after a serious disruption. It states which activities to restart first, how quickly, with which resources and who takes the decisions. It is based on the business impact analysis and must be tested with periodic exercises. It is not a theoretical document: it must be usable by people under pressure.
Is a continuity plan mandatory for an SME?
In general no, but there are important exceptions. Companies within the scope of the NIS2 Directive must adopt business continuity and crisis management measures. Other sector rules and many contracts with large customers may require it. Even where it is not mandatory, it is often the difference between a shutdown of a few hours and one of a few weeks.
What is the difference between RTO and RPO?
The RTO is the time within which an activity or system must restart after an incident. The RPO indicates how far back you must be able to recover data, that is, how much information you can afford to lose. An RTO of four hours and an RPO of one hour mean: restart within four hours, losing at most the last hour of data. The RTO must always be shorter than the maximum tolerable period of disruption.
How often should the plan be tested?
ISO 22301 does not set a single frequency: it requires an exercise programme consistent with the risks and the continuity objectives. For an SME, at least one tabletop exercise and one restore test a year is reasonable. It is worth adding a test after every significant change, such as a new ERP or new premises. Every test should produce improvement actions with an owner.
Is a cloud backup enough for business continuity?
No. Backup is a necessary technical measure, but it covers only data, and only if the restore has been tested. Business continuity also covers people, premises, suppliers, communication with customers and decisions. In addition, a backup permanently connected to the network can be hit by the same attack: you need at least one isolated copy and a verified restore procedure.
Do you need ISO 22301 certification to have a good plan?
No, you can build an effective plan without being certified. Certification is useful when you want a management system that keeps the plan going over time and when customers, tenders or partners ask for independent proof. The certificate is issued by an accredited body, runs on a three-year cycle with periodic surveillance audits and requires you to show that BIA, strategies, plans and exercises are in place and active.
How much does a business continuity plan cost?
There is no standard cost, because it depends on very different factors. The number of sites and prioritized activities, the complexity of IT systems, dependence on critical suppliers and how much is already documented all count. The choice between a simple plan and an ISO 22301 certified system also matters. The most reliable way to find out is to start from an initial analysis and ask for a quote.
