A single week of downtime costs the average small business between $8,000 and $74,000, according to FEMA's preparedness research. Yet roughly 75% of small businesses have no disaster recovery or continuity plan in place. For enterprises with dedicated resilience teams, building a business continuity plan is a structured project. For a small business owner or a lone operations manager, it feels like one more thing on a list that never gets shorter.
This guide covers what a business continuity plan for a small business actually needs to include, why most enterprise templates create more work than they save, and how to build a plan that fits your team size and budget.
TL;DR
- A small business continuity plan protects revenue, customers, and reputation when disruption hits, but it does not need to be 200 pages long
- Enterprise BCP templates assume departments, committees, and dedicated resilience staff that small businesses do not have
- Start with three things: identify your critical processes, document who does what when they break, and test the plan once
- Business impact analysis is the foundation, and AI tools now make it possible for a single person to run one across an entire organisation
- Software helps if you plan to maintain and exercise the plan over time, not just write it once
What is a business continuity plan for a small business?
A business continuity plan is a documented set of procedures that describes how an organisation will continue operating during and after a disruption. For a small business, that means answering a simple question: if your office, your systems, or your key people are unavailable tomorrow, what happens to your customers and your revenue?
The scope is smaller than an enterprise BCP, but the stakes are higher. A large company can absorb a week of disruption across one division. A 50-person company with one location and one critical system cannot. The plan does not need to cover every theoretical scenario. It needs to cover the disruptions that would actually stop you from serving customers and generating revenue.
| Enterprise BCP | Small business BCP |
|---|---|
| 50-200 pages across multiple plans | 5-15 pages, one document |
| Dedicated resilience team maintains it | Owner or operations manager maintains it |
| Annual BIA cycle with department interviews | Lightweight BIA focused on top 5-10 processes |
| Formal exercise programme with regulators watching | One tabletop walkthrough per year minimum |
| Multiple recovery sites and redundancy | Cloud backups, remote work capability, key vendor contacts |
Why enterprise templates do not fit small businesses
The most common mistake small businesses make is downloading an enterprise BCP template and trying to fill it in. These templates are built for organisations with dedicated business continuity managers, formal governance structures, and multi-layered approval processes. They create three problems for small teams.
They assume roles that do not exist
Enterprise templates reference a crisis management team, a business continuity coordinator, an IT disaster recovery lead, and an executive sponsor. In a 30-person company, the owner is all four. The template creates an illusion of structure that does not match reality, and the gaps become obvious the moment you try to assign names to roles.
A small business plan should name real people and their actual responsibilities during a disruption, not fill in an org chart designed for a company ten times your size.
They demand data you do not have
Enterprise BIA processes collect recovery time objectives, maximum tolerable downtime, and dependency maps across dozens of departments. A small business needs to answer a simpler version of the same questions: which processes make us money, how long can they be down before we lose customers, and what do they depend on? A focused business impact analysis that covers your top 5-10 processes is more useful than a 50-page document that tries to map everything and ends up mapping nothing.
They create a document nobody maintains
A 200-page enterprise BCP requires a full-time person to keep current. When the plan lives in a shared drive and nobody owns it, it drifts out of date within months. Contact lists go stale, vendor details change, and the recovery procedures describe a version of the business that no longer exists. For small businesses, a shorter plan that someone actually reviews quarterly is worth more than a comprehensive plan that nobody touches after day one.
What to include in a small business continuity plan
A practical small business BCP covers five areas. Each one should be short enough to read in a few minutes and specific enough to act on during a real incident.
Critical process identification
List the 5-10 processes that generate revenue, serve customers, or keep you in regulatory compliance. For a professional services firm, that might be client delivery, invoicing, and email. For a manufacturer, it is production, shipping, and order management. Everything else is important but not critical. The plan covers critical processes first and everything else later, if at all.
Recovery priorities and timeframes
For each critical process, define how long it can be down before the impact becomes serious. This is your recovery time objective. A retail business that loses its point-of-sale system needs it back in hours. A consultancy that loses access to project files can probably manage for a day. These timeframes drive every other decision in the plan: what you back up, what redundancy you build, and where you spend money on resilience.
People, roles, and contact information
Who makes decisions when the owner is unavailable? Who contacts customers? Who talks to vendors? Name a primary and a backup for each role. Include personal phone numbers, not just office lines. This section goes stale fastest, so build in a quarterly review reminder.
Technology and data protection
Document your backup strategy: what is backed up, how often, where backups are stored, and when they were last tested. Cloud services have made this dramatically cheaper for small businesses, but a backup that has never been tested is not a backup. Include your key vendor contacts (hosting provider, ISP, software vendors) and any account numbers or escalation paths you would need during an outage.
Communication plan
How will you reach employees if email and office phones are down? How will you notify customers of a service disruption? Pre-draft two or three message templates for common scenarios (IT outage, facility closure, key person unavailable) so you are not writing communications under pressure. Keep it simple: a group text chain and a pre-written customer email cover most small business scenarios.
How to build a small business continuity plan step by step
You do not need a consultant or a six-month project. A small business owner or operations manager can build a functional BCP in a few days of focused work.
- Run a lightweight BIA. Interview yourself and your key team leads. For each process, answer: what does it do, who depends on it, what technology does it need, and how long can it be down? This takes 2-4 hours for a 20-50 person company.
- Rank your processes by impact. Not everything is critical. Separate the processes that stop revenue from the ones that cause inconvenience. Focus the plan on the top tier.
- Document recovery procedures for each critical process. Be specific: not "restore the database" but "contact AWS support at [number], request RDS restore from latest snapshot, verify data integrity by checking last 24 hours of transactions."
- Assign roles and update contact lists. Name real people. Include personal numbers. Add a backup for every role.
- Test the plan once. A 90-minute tabletop exercise where you walk through a scenario ("the office is inaccessible for a week, what do we do?") will expose every gap the document missed. Fix what you find and schedule the next test.
- Set a quarterly review. Put it in the calendar. Review contact lists, vendor details, and any process changes. 30 minutes per quarter keeps the plan alive.
Does a small business need ISO 22301?
ISO 22301 is the international standard for business continuity management systems. It provides a structured framework for building, maintaining, and improving a BCM programme. Large enterprises and regulated industries often certify against it.
Most small businesses do not need certification. But the standard's structure is useful as a reference even if you never certify. The core principles (understand your organisation, assess risks, build plans, exercise them, improve) apply at any scale. Following ISO 22301's logic while adapting the depth to your size gives you a plan that is both practical and aligned with international best practice.
If you work with enterprise clients or in regulated industries (financial services, healthcare, government contracting), ISO 22301 alignment may be a contractual requirement even at your size. In that case, software that builds on the standard from day one saves significant effort versus retrofitting a spreadsheet-based plan later.
When business continuity software makes sense for a small business
A small business with one location, ten employees, and five critical processes can manage a BCP in a document. Once any of the following become true, software starts earning its cost.
- You have multiple locations or a distributed workforce and need to coordinate across sites
- Your BIA involves interviewing more than 10-15 people and consolidating their responses
- Regulatory or client requirements demand structured evidence of your BCM programme
- You need dependency mapping across systems, vendors, and processes that a spreadsheet cannot visualise
- Your plan keeps going stale because nobody has time for the manual maintenance
- You are a team of one trying to run a BCM programme that would normally require 3-5 people
The last point is where AI-native platforms have changed the economics. A single person can now run AI-led BIA interviews across an entire organisation, auto-generate recovery plans from the collected data, and run exercises without scheduling weeks of meetings. What used to require a team now requires a tool and one person who knows how to use it.
How Fortiv helps small teams build and maintain a BCM programme
- AI-led BIA interviews collect impact data from every department without requiring you to schedule individual calls. Stakeholders respond on their own time through voice, chat, or email. For a team of one managing 20-50 departments, this is the difference between a three-month project and a two-week project.
- Recovery plans are generated from your actual BIA data, not generic templates. The plans reflect your real processes, dependencies, and recovery priorities.
- Dependency mapping visualises how your processes, people, technology, and vendors connect. When something changes, you see immediately which plans are affected.
- Exercises and simulations run in-platform against your live organisational data. Micro-sims, what-if scenarios, and AI-generated tabletop exercises let you test readiness without the logistical overhead of traditional exercises.
- The platform is built on ISO 22301 from day one. You do not need to retrofit compliance onto a tool that was not designed for it.
Fortiv does not require significant setup or a dedicated implementation team.
Next step
If you are building a business continuity plan for a small business and want to move faster than spreadsheets and templates allow, Fortiv can help.
Book a 30-minute walkthrough to see how a team of one can run a full BCM programme with AI handling the heavy lifting.
Related articles
Business impact analysis: a complete guide
Business continuity plan template
