A business continuity plan for a small business

Key takeaways

A business continuity plan for a small business is a short document that says how you keep serving customers when something stops: a person, a system, a site, a supplier or your data. Businesses that do everything in-house need one most, because every function has a single point of failure. Two pages is enough.

• 5 disruptions to plan for: people, systems, premises, suppliers and data.
• 43% of UK businesses reported a cyber breach or attack in the last year.
• 2 pages: critical activities, who covers, contacts, where things are.
• Test it once a year with a one-hour walk-through.

What is a business continuity plan?

A business continuity plan is a documented set of arrangements for keeping critical activities running, or restoring them quickly, during a disruption. For a small business it is practical: a list of what must not stop, who can do it, how to reach people and where the essentials are kept.

• The hidden costs of doing everything in-house
• Key person dependency: when one person holds it all

What should you plan for?

Plan for five kinds of disruption. The DSIT Cyber Security Breaches Survey 2025/2026 found 43% of UK businesses reported a breach or attack in the previous year, so data and systems belong on every list, but for most small firms the commonest disruption is simply a key person being unavailable.

• People: illness, resignation or bereavement.
• Systems: email, phones, internet or software down.
• Premises: no access to the office or site.
• Suppliers: a key supplier fails or is late.
• Data: loss, corruption or a cyber incident.

• The one-person department: risks and hidden costs
• Cyber security without an IT department

What goes in a two-page plan?

Keep the plan short enough to be read in a crisis.

• Critical activities and how long each can stop.
• A named primary and deputy for each.
• Contact details for staff, key customers and suppliers.
• Where passwords, backups and key documents are held.
• How customers will be told.
• Who decides, and who decides if they are unavailable.

• Sharing passwords at work: the risk and the fix
• The cost of undocumented processes

Why are in-house-only businesses more exposed?

A business that does everything in-house concentrates every function in a few people, one office and one set of systems. A single event can remove several functions at once. Spreading some work across a second team or location gives a fallback that an in-house-only setup lacks.

• Business continuity for outsourced operations

When is a formal plan unnecessary?

A sole trader with few customers may need only a note of logins, contacts and what to tell clients. The more people and customers depend on the business, the more a written plan is worth. Some customers and insurers will ask to see one.

How do you decide what is critical?

For each activity, ask how long it could stop before customers, cash or legal duties are harmed. Answering enquiries may tolerate hours. Payroll tolerates none on pay day. Marketing can pause for a week or two. Rank the list by tolerance and plan cover for the least tolerant first. Most small businesses end up with five to eight truly critical activities.

• Hours: phones, customer email, urgent deliveries.
• Days: invoicing, supplier payments, order processing.
• Fixed dates: payroll, VAT, statutory filings.
• Weeks: marketing, reporting, improvement projects.

• Business owner who cannot take a holiday? Fix this

What does a walk-through test involve?

Gather the team for an hour and pick one scenario, such as the office manager being off for a month starting tomorrow. Go through the critical activities in turn and ask who does each, how they would know what to do and what they would need access to. Write down every gap. You will usually find missing logins, undocumented steps and at least one task nobody knew existed.

What mistakes do small businesses make?

The frequent mistakes are planning only for fire and flood while ignoring absence, keeping the plan on the system that would be unavailable, listing contacts that are out of date and never testing. A plan that names a deputy who has not been trained is also common. Naming someone is not the same as preparing them.

Where should the plan be kept?

Keep the plan somewhere you can reach if the office and your main systems are unavailable. A printed copy at home with two senior people, plus a copy in a separate cloud account, covers most situations. Make sure it includes phone numbers, because email may be the thing that is down. Check twice a year that the copies match and the contacts are current.

What does this look like in practice?

A pattern we see after a long absence: the business was fine on systems and backups, and had no plan for the administrator being off for six weeks. Invoices stopped. Cash followed a month later.

• See client work
• BPO Solutions for UK businesses

Business continuity checklist

Draft it this month.

• List your critical activities.
• Name a deputy for each.
• Check backups exist and can be restored.
• Store contacts and credentials securely off-site.
• Walk through one scenario with the team.
• Set an annual review date.

• The hidden cost audit: score your business in an hour

Next step

Tell us which activity your business could least afford to stop. We will suggest a cover arrangement in a 30-minute call.