How to write a business continuity policy

Why business continuity is more than backups

Backups recover data; business continuity keeps the business running. A business continuity policy defines how critical functions continue or are quickly restored during a disruption — an outage, a supplier failure, a cyberattack or a site loss.

What to include

Scope and objectives — which functions are critical and the tolerance for downtime.
Business impact analysis (BIA) — identify critical processes, dependencies and the cost of downtime.
Recovery objectives — RTO (how fast you must recover) and RPO (how much data loss is acceptable) per function.
Continuity strategies — failover, alternate sites, manual workarounds, key supplier alternatives.
Roles and communication — who declares an event, who leads, how staff and customers are informed.
Testing — at least annual exercises (tabletop or full), with results feeding improvements.
Review — keep the plan current as the business changes.

Common mistakes

A plan that lists IT recovery only, ignoring people, premises and suppliers.
RTO/RTO set without a BIA, so they are guesses.
Never exercising the plan, so gaps surface only during a real crisis.

Framework alignment

Maps to ISO 27001:2022 Annex A 5.29–5.30 (continuity and ICT readiness), the SOC 2 availability criteria, NIST CSF Recover, and supports DORA operational-resilience requirements.

Primary sources

NIST SP 800-34 — Contingency Planning Guide (BIA, recovery strategies, RTO/RPO) (csrc.nist.gov/pubs/sp/800/34/r1/final).
ISO/IEC 27001:2022 — Annex A controls 5.29–5.30 (continuity, ICT readiness) (iso.org/standard/27001).
ENISA — business continuity and resilience resources (enisa.europa.eu).

Generate it in minutes

See a sample business continuity policy or generate yours free.

Frequently asked questions

What is the difference between backups and business continuity?

Backups recover data; business continuity keeps the whole business running through a disruption. A continuity plan covers people, premises and suppliers too — not just IT recovery — so critical functions continue or are quickly restored during an outage, supplier failure, cyberattack or site loss.

What is a business impact analysis (BIA)?

A BIA identifies your critical processes, their dependencies and the cost of downtime. It is the basis for setting realistic recovery objectives (RTO and RPO). Without a BIA those objectives are guesses, which is a frequent audit and resilience gap.

How often should a business continuity plan be tested?

At least annually, through a tabletop or full exercise, with results feeding improvements. Plans that are never exercised reveal their gaps only during a real crisis. Regular testing also supports DORA operational-resilience expectations for in-scope financial entities.