Business Continuity Plan Checklist
A checklist for a business continuity plan in seven areas, with critical functions and their RTO and RPO, owners, last-tested dates and the completion counted per area and overall.
Free. Fill in, print, save as PDF or download as Word without an account. Saving to your account needs a free account.
Country versions
- International
- Japan *
- Germany *
* check with local advice
A template, not advice.
Read more
What it is
A business continuity plan (BCP) answers one question before a bad day arrives: if this happened tomorrow, how would we keep serving customers? This checklist helps a small business see what is already in place and what is missing. It works in seven areas: governance, people and contacts, IT and data, suppliers, premises, communications and testing. It starts with the part that makes the rest concrete, a short table of critical functions, each with the longest outage it can survive (RTO) and the longest stretch of data it can afford to lose (RPO).
Tick what is true, name an owner for each area and note when it was last reviewed or tested. The form counts the ticks per area and overall, so you can see where to work next. The percentages show how far you have come through the checklist, not how well prepared you are; a box ticked for something that was never tested counts for little, which is why a testing log is part of the form. It is a planning aid and a general template, not the plan itself and not legal, insurance or safety advice.
When to use it
- You are writing a first continuity plan, or reviewing an old one before it goes stale.
- A customer, bank, insurer or tender asks whether you have a continuity plan.
- A near miss or an outage has just shown what would have gone wrong.
- You move offices, change IT provider or depend on a new critical supplier.
- You want a yearly routine to check backups, contact lists and fallback arrangements.
How to fill it in
- Enter the business, the plan owner, the date and the version, and set the next review.
- List the three to six functions without which you cannot serve customers. Give each an owner, an RTO and an RPO in hours, and a workaround.
- Go through the areas one by one and tick only what is true today.
- Name an owner for each area and the date it was last reviewed or tested.
- Fill in who does what in a crisis, and keep a copy that can be read without the office network.
- Record every test in the log, including the ones that went badly. Tick a testing item only after a real test.
- Read the percentages, pick the unticked items to work on next quarter, and print the checklist for sign-off.
Common mistakes
- Ticking boxes to look good. An item is ticked when it is true today, and it counts for most when it has been tested.
- Setting an RTO or RPO without asking the people who run the function.
- Making backups but never restoring one to see whether it works.
- Keeping the contact list only on the office network or on one person's phone.
- Having a plan with one owner and no deputy.
- Never updating the plan after a move, a new system or a new supplier.
- Reading the percentage as a grade for the business.
Steps at a glance
- Fill in
- Check the preview
- Save as PDF, Word or Excel
Country versions
Pick the country you need. Each version uses the wording and layout commonly found there; a version marked “check with local advice” should be read by someone who knows the local rules before it is used.
- International (XX): Written in English, Korean, Japanese, German
- Japan (JP): Written in Japanese, English – check with local advice
- Germany (DE): Written in German, English – check with local advice
Designs
The same form in several designs. The fields and the wording stay the same; only the look changes.
- Compact
- Ledger
- Boxed form
- Plain (black and white)
- Banner
- Classic
- Modern
- Minimal
- Side band
- Warm
- Formal
- Executive
Your details fill it in
Fields that ask for your name, address or company details are filled from My details, so you do not type them again; you can still change any field for one form. Signed in, your details stay in your account; otherwise they stay in this browser only. A passport, identity or social security number is never saved.
Questions
- What are RTO and RPO?
- RTO is the longest a function can be down before the damage is too big. RPO is how far back you can afford to lose data. If the order system may be down for a day but only an hour of orders may be lost, the RTO is 24 hours and the RPO is 1 hour. The RPO decides how often a backup must run.
- How many critical functions should I list?
- Three to six is usual for a small business. If you list everything as critical, nothing is: pick the functions whose loss would stop revenue, harm people or break a promise to customers within days.
- Do I need this if my business is very small?
- A very small business needs the same questions, answered more briefly. Even one person has critical functions, a backup that must be restored once, and customers who need to hear from you. Tick what applies and leave out nothing important just because the business is small.
- How often should I test?
- Walk through the plan at least once a year and after big changes. Restore a backup more often, for example every quarter. Evacuation drills may be required by local rules, so check them. Write each test in the log.
- Does this checklist meet ISO 22301?
- QuoteBill cannot say. The areas follow the common structure of continuity guidance, but a standard asks for a management system, not a checklist, and we make no claim of conformity. Use it to prepare, and ask your adviser or auditor what they need.
- Is this form legal, tax or accounting advice?
- No. It is a template: it gives you the usual structure and wording, not advice. Rules differ by country and case, so have someone qualified read anything that matters before you sign, send or file it.
- Which countries and designs does it come in?
- It comes in 3 country versions: International, Japan, and Germany. 12 designs.
A form is a template, not legal, tax or accounting advice. Rules differ by country and case.