In short: The UK government's Business Continuity Management Toolkit, written for small and medium organisations, asks four questions: what are your key products and services, what do you need to deliver them, what are the risks, and how will you keep going? The NCSC adds: back up all the data your business needs.
Key facts
- The government's Business Continuity Management Toolkit says it was developed specifically for small and medium organisations in the commercial and voluntary sector that are relatively new to business continuity. Source
- The toolkit asks: what are your key products and services, what critical activities and resources deliver them, what are the risks to them, and how will you maintain them if you lose access to premises or utilities? Source
- Its business impact analysis asks you to record the impact of a disruption for the first 24 hours, 24 to 48 hours, up to one week and up to two weeks. Source
- The National Cyber Security Centre says to make a backup of all the data your business needs to operate, stored online or on an external device that should not stay connected when not in use. Source
- The NCSC says it's important to know how to restore your backup and to check that it contains all your important data. Source
Want this written down for your home? Household Emergency Plan Pack — printable, £6.99.
A business continuity plan sounds like paperwork for big firms, but for a small business it can be a single sheet: what matters most, how long you could manage without it, and what you'd do instead. This guide follows the government's Business Continuity Management Toolkit, listed on GOV.UK, and the National Cyber Security Centre on backups. It sits with our household plan guides.
The four questions
The toolkit, written for small and medium organisations new to the subject, says business continuity comes down to four questions:
- What are your key products and services?
- What activities and resources do you need to deliver them?
- What are the risks to those activities?
- How will you keep them going if something happens, such as losing access to your premises or utilities?
How long could you manage?
The toolkit's business impact analysis asks you to note what a disruption would mean over the first 24 hours, 24 to 48 hours, up to one week and up to two weeks. From that, you work out the longest you could manage without each key service. That tells you what to protect first.
A one-page outline you can copy
Business name / date / next review date
1. Key products and services (top three)
2. What each one needs: people, premises, equipment, suppliers, data, power, phone and internet
3. How long we could manage without each: 24 hours / 48 hours / one week / two weeks
4. Main risks: for example a power cut, flooding, a supplier problem, staff illness, losing access to data
5. Workarounds: where we'd work from, a back-up supplier, card payments if the till is down, how we'd take orders by phone
6. Who does what: the person in charge, their deputy, who tells staff and who tells customers
7. Key contacts: staff, landlord, insurer, bank, main suppliers, IT support, your electricity network operator (call 105 in a power cut)
8. Data and records: what's backed up, where, and who can restore it
9. Grab list: keys, a charged phone and laptop, a printed copy of this plan and contact list
Backups: the part most plans need
The NCSC says to make a copy of all the data your business needs to operate, such as your website, emails, invoicing, documents and customer information. You can back up online or to an external device such as a USB stick or hard drive. If you use a device, keep it somewhere secure, and don't leave it connected when not in use. The NCSC suggests using both for extra safety, turning on 2-step verification for online backups, and checking you know how to restore them.
Getting it done tick-list
- Top three services written down
- Impact noted for 24 hours, 48 hours, one week, two weeks
- One workaround agreed for each
- Contacts list printed and stored off site
- Backup made and one restore tested
- Plan shared with staff and a review date set
Your Local Resilience Forum's website often publishes a community risk register for your area; GOV.UK's contact page links to each forum in England and Wales.
Limitations
This page is a simple starting point based on official guidance. The government toolkit is an older document based on an older British Standard (BS25999), so larger or regulated businesses should take professional advice. It isn't legal, insurance or IT security advice.
Turn this guide into a written plan
Reading helps. Writing it down is what makes it work when the phones are flat. Start with the free plan builder, or get the full printable version:
Your whole household planHousehold Emergency Plan Pack£6.99
Bundle · £15.97 separatelyPrepared, Not Panicked bundle£9.99Real pages shown before you buy · instant PDF · one-off price · 30-day refund.
Get the free 72-hour UK household checklist
Tick-box lists for each part of a UK home emergency kit, plus the key numbers on one page. Enter your email and we'll take you straight to the download.
That email address doesn't look right — please check it and try again.
We'll also email you when we publish new guides — occasional, never daily. Unsubscribe any time. See our privacy notice.
Frequently asked questions
Is there a free government business continuity template?
GOV.UK hosts a Business Continuity Management Toolkit, produced by the Cabinet Office's Civil Contingencies Secretariat for small and medium organisations. It's an older document, so use it alongside current advice such as the NCSC's small organisations guide.
What should a small business continuity plan include?
At minimum: your key products and services, what you need to deliver them, how long you could manage without each, the risks, your workarounds, who does what, key contacts and where your data backups are. The outline on this page fits on one sheet.
How often should we review the plan?
The toolkit says business continuity plans should be regularly reviewed, updated and exercised. Many small firms pick a fixed date each year and test one part, such as restoring a backup.
Sources
- Cabinet Office (GOV.UK): Business Continuity Management Toolkit (checked 30 Oct 2026)
- GOV.UK: Resilience in society, infrastructure, communities and businesses (last updated 10 Dec 2014; checked 30 Oct 2026)
- National Cyber Security Centre: Small organisations guide, backing up your data (checked 30 Oct 2026)
- GOV.UK: Local resilience forums, contact details (checked 30 Oct 2026)