Most small businesses assume they would cope if something went badly wrong — a ransomware attack, a burst pipe over the server, a supplier outage. In reality, the businesses that recover quickly are the ones that decided, in advance, exactly what they would do. That decision is a business continuity plan. This guide explains what a BCP is, how it differs from disaster recovery, and how to build one that actually works.
A business continuity plan (BCP) is a documented set of procedures for keeping your critical business functions running during and after a disruption. It identifies what must keep operating, who is responsible, how you communicate, and how you recover — so a crisis becomes a managed process rather than a scramble.
What is a business continuity plan?
A business continuity plan sets out, in writing, how your business will keep serving customers and protecting its people when normal operations are interrupted. It covers far more than technology: staffing, premises, communications, key suppliers and finances all feature. The goal is resilience — the ability to absorb a shock and keep functioning.
BCP vs disaster recovery: what is the difference?
The two terms are often confused. They are related but not the same.
- Business continuity (BCP)
- The broad plan for keeping the whole business operating during a disruption — people, processes, premises, communications and finances. It answers: how do we keep trading?
- Disaster recovery (DR)
- The IT-focused subset that restores systems, applications and data after an incident. It answers: how do we get the technology back? DR sits inside a complete BCP.
- RTO — Recovery Time Objective
- The maximum acceptable time to restore a given system after an incident. A one-hour RTO means that system must be back within an hour.
- RPO — Recovery Point Objective
- The maximum acceptable data loss, measured in time. A four-hour RPO means you must be able to recover to a point no more than four hours before the incident, so backups run at least that often.
In short, business continuity keeps the business alive; disaster recovery brings the technology back. You need both, and RTO and RPO are the numbers that connect them.
How to build a business continuity plan
A workable BCP does not have to be a hundred-page document. For a small business, a clear, tested plan of a dozen well-considered pages beats a shelf-ware tome nobody reads. Build it in five steps:
- Run a business impact analysis. List your critical functions — taking orders, invoicing, delivering services — and work out how long you could survive without each, and what it would cost per hour or day of downtime.
- Assess your risks. Identify the realistic threats: cyber attack, hardware failure, power or internet outage, fire, flood, loss of a key person or supplier.
- Set RTO and RPO per system. For each critical system, agree how fast it must come back (RTO) and how much data you can afford to lose (RPO). These targets drive your backup and recovery design.
- Document response procedures. Write down who does what, the order of recovery, emergency contacts, and how you will communicate with staff, customers and suppliers if email or phones are down.
- Test and review. Restore a backup, walk through the plan, and fix what does not work. Review at least annually and after any major change.
What a good plan contains
- A prioritised list of critical business functions and their acceptable downtime.
- RTO and RPO targets for each key system, agreed by the business.
- Clear roles and responsibilities, with named people and deputies.
- Tested, isolated backups you can actually restore from — including offline or immutable copies.
- A communications plan for staff, customers, suppliers and, if needed, regulators.
- Alternative ways of working — remote access, a backup location, manual fallbacks.
- A testing schedule and a record of past tests and fixes.
Why it matters for Australian small businesses
Small businesses are often the most exposed, because they have the least slack to absorb a shock. A ransomware incident that encrypts your files, or a flood that takes out your premises, can threaten the whole business. If you handle sensitive client information — as many service and NDIS providers do — a continuity plan also supports your obligations under the Privacy Act and the Notifiable Data Breaches scheme. The Australian Cyber Security Centre offers practical guidance on preparing for and responding to incidents at cyber.gov.au.
The honest takeaway
A business continuity plan is only as good as its testing. The most common failure is not the absence of a plan — it is a plan that was written once, never rehearsed, and quietly went out of date. Backups that were never test-restored have a habit of failing exactly when you need them. That ongoing discipline of testing, updating and verifying is where our backup and business continuity services come in.
Related services
Learn more about our backup and continuity services and cyber security services, read our companion guide to disaster recovery planning, or book a free IT assessment. Ready to talk? Contact our Sydney team.
Frequently asked questions
A business continuity plan (BCP) is a documented set of procedures that keeps your critical business functions running during and after a disruption such as a cyber attack, outage, fire or flood. It identifies what must keep operating, who does what, and how the business communicates and recovers.
Business continuity is the broader plan for keeping the whole business operating during a disruption — people, processes, premises and communications. Disaster recovery is the IT-focused subset that restores systems, applications and data. DR is a component of a complete BCP.
RTO (Recovery Time Objective) is the maximum acceptable time to restore a system after an incident. RPO (Recovery Point Objective) is the maximum acceptable amount of data loss, measured in time — for example, a four-hour RPO means backups run at least every four hours. Both are set per system based on business impact.
Yes. Small businesses are often more exposed than large ones because they have fewer reserves to absorb downtime. A ransomware attack, extended outage or lost premises can be existential. Even a short, practical BCP dramatically improves the odds of recovering quickly.
At least annually, and after any significant change to your systems, staff or premises. Testing includes restoring backups and walking through the plan so that gaps are found before a real incident, not during one.