Opens in a new tab
Modern office desk with a laptop displaying cloud security icons, documents, plants, coffee mug, external drive, binders, and office supplies, with an open workspace in the background.

A Business Continuity Plan Template for a 15 to 75 Person Office: The Version You’ll Actually Keep Current

By Jason Russell · October 30, 2026

Hurricane season officially ends November 30, which makes this a good month to write down what your office would do if the next bad week came from a storm, a ransomware note, or a dead server. Below is a business continuity plan template built for a 15 to 75 person office: short enough for one person to keep current, and specific enough to use at 7 a.m. on a bad day.

Most small offices I see have one of two things: no plan, or a binder that was accurate the year someone printed it. The free government templates are a good start, but both read as if they were written for bigger organizations. Ready.gov’s template sketches an org chart with a “Production Recovery Team” and a “Support Team.” FEMA’s covers devolution, reconstitution, and multi-year strategic planning. A 30-person office needs the same ideas in a form an office manager can update in an afternoon.

In order: continuity versus disaster recovery, the template in eight parts, three scenarios to test it against, and what a plan won’t fix.

Business continuity vs. disaster recovery

NIST defines a business continuity plan as instructions that “describe how an organization’s mission/business processes will be sustained during and after a significant disruption.” A disaster recovery plan, in NIST’s usage, is “an information system-focused plan designed to restore operability” of systems at an alternate site after an emergency (NIST SP 800-34). In plain English: the continuity plan keeps the business serving clients, and the disaster recovery plan gets the technology back.

In a small business, they belong in the same document. Ready.gov says an IT disaster recovery plan “should be developed in conjunction with the business continuity plan” and recommends documenting it “as part of the business continuity plan” (Ready.gov). If you came here looking for a disaster recovery plan template, Parts 3 and 4 below are it.

Four rules that keep a plan current

  • Names, not job titles. Write a person’s name and cell number. A title doesn’t answer the phone.
  • One owner. One person keeps the master copy and makes every update.
  • Readable without your systems. If the server is down, a plan saved only on the server is useless. Keep printed copies with the owner and one backup person. CISA’s ransomware guide makes the same point about incident plans: keep “a hard copy of the plan and an offline version.”
  • A fixed review date. NIST’s guide says plans should be reviewed “at least annually,” and that contact lists “should be reviewed and updated more frequently.”

The business continuity plan template

Copy these eight parts into a document and fill in the brackets. Anything you can’t fill in is a finding, not a failure.

Part 1: Who decides

  • Plan owner: [Name and cell number]
  • Can declare an emergency and activate this plan: [Name and cell number]
  • If they can’t be reached: [Second and third names, in order]
  • Can approve emergency spending, and up to how much: [Name and dollar limit]
  • Has emergency access to admin passwords: [At least two names]

Part 2: How you reach staff

  • First channel: [Group text, Teams, or a call list]
  • Backup channel if email and phones are down: [Personal cell numbers or a messaging app]
  • Everyone checks in by: [Time, such as two hours after the alert]
  • Who calls whom: [Each manager and the people they call]
  • Where we meet if the building is unsafe: [Place]
  • Where the printed list lives: [Locations]

NIST suggests printing emergency contacts on small cards staff can carry, and reminds planners that personal contact information “must be appropriately protected.”

Part 3: The five systems that matter most

This table is a business impact analysis template shrunk to one page. NIST defines the recovery time objective as how long a system “can be in the recovery phase before negatively impacting” the business. It defines the recovery point objective as “the point in time to which data must be recovered after an outage.” Put plainly: how long can you go without it, and how much recent work can you afford to re-enter? If your backups run nightly, a bad day can cost you up to a day of work.

System Down no longer than Lose no more than Workaround
Example: practice or tax software 4 hours 1 hour of entries Printed schedule and paper forms
[System 2] [Hours or days] [Minutes, hours, or a day] [Manual process]
[System 3] [Hours or days] [Minutes, hours, or a day] [Manual process]
[System 4] [Hours or days] [Minutes, hours, or a day] [Manual process]
[System 5] [Hours or days] [Minutes, hours, or a day] [Manual process]

The usual five are email, the main software your business runs on, shared files, phones, and internet. Ready.gov’s template asks you to document every manual workaround; the last column is the short version. For a dollar figure, see my earlier post on what downtime actually costs a small business.

Part 4: Where backups live

  • What’s backed up: [Servers, Microsoft 365 or Google Workspace, data from your main software, scanned records]
  • Copy 1, on site: [Device and location]
  • Copy 2, off site and outside Florida: [Provider and region]
  • Copy 3, offline or locked so it can’t be changed: [Where]
  • Who can start a restore, 24/7: [Name or provider, and phone]
  • Last test restore: [Date, what was restored, and how long it took]

The last line is the one that matters. A backup you haven’t restored is a hope. CISA recommends “offline, encrypted backups of critical data” that you test regularly (CISA). If your email and files live in the cloud, check whether your Microsoft 365 or Google Workspace data is really backed up. I cover the 3-2-1 backup rule in a separate post.

Part 5: How people work if the office is closed

  • Can work from home today: [Names with company laptops and remote access]
  • Can’t, and what they do instead: [Names and plan]
  • How remote staff reach files and software: [Method]
  • Main phone number forwards to: [Number, who can change it, and where the steps are]
  • Backup internet for the office: [Second provider, cellular, or satellite]
  • If the office is out for weeks: [Alternate space]

Backup internet is easy to put off until the day you need it. I look at whether satellite internet works as a backup line in a separate post.

Part 6: Vendor, insurer, and outside contacts

Who Phone Account or policy Call when
IT provider [24/7 line] [Account] Any outage or security concern
Internet and phone carriers [Support line] [Account] Line down or call forwarding
Key software vendors [Support line] [Customer ID] Software won’t run or restore
Landlord or building [Number] [Lease or unit] Power, water, or access
Insurance agent [Number] [Policy numbers] Property damage or business interruption
Cyber insurance claims line [Number] [Policy number] Right after a cyber incident
Bank [Number] [Accounts] Fraud, payroll, or wire problems
Attorney [Number] [Client number] Breach or contract questions

If you carry cyber insurance, read the policy now for what it expects in the first hours, and note it by the claims line.

Part 7: What you tell clients

Ready.gov’s crisis communications guidance suggests messages written in advance “with blanks to be filled in,” approved ahead of time, and stored where you can reach them remotely (Ready.gov). Write three now:

  1. We’re closed: [How to reach us, and when we’ll update you]
  2. Our systems are down: [How to reach us, and which appointments or deadlines are affected]
  3. Security incident holding statement: [What you can say before you know the facts, reviewed by your attorney and insurer first]
  • Who approves messages: [Name]
  • Where they go, and who posts them: [Website banner, phone greeting, email, social media]

Part 8: The once-a-year test

Pick a month and put it on the calendar. May works well in Central Florida, since hurricane season starts June 1. Then:

  1. Run a one-hour tabletop. NIST describes a tabletop as a “discussion-based” exercise: someone presents a scenario and the group talks through who does what. Use one of the scenarios below.
  2. Restore something real. Time it and compare the result with Part 3.
  3. Call every number in Parts 1, 2, and 6.
  4. Update, date, and print the plan. Note what changed.

Ready.gov’s business continuity planning page has free exercise materials, including a situation manual and a facilitator and evaluator handbook.

Test it against more than a hurricane

Hurricanes are the obvious Central Florida scenario; I covered what to ask your IT provider about storms in my post on how to vet IT companies in Orlando. Run these three as well.

Ransomware on a Monday morning

Email may be down or untrustworthy, so the backup channel in Part 2 matters. Your first calls are your IT provider and your cyber insurer, before anyone starts wiping machines. CISA’s guide also recommends reporting the incident to CISA or your local FBI field office. Then: is the offline copy in Part 4 clean, and how long will a full restore take? Our five-step ransomware defense plan covers prevention, and ransomware recovery is what we do when prevention wasn’t enough.

The server that won’t turn back on

Not every disaster is an attack. The plan forces one question: how long would a full restore onto new hardware take, and does that fit the number in Part 3? Ready.gov says data restoration times “should be confirmed and compared” with your recovery time objectives, and recommends keeping copies of program software so it can be reinstalled on replacement equipment. If the honest answer is three days and your table says four hours, you’ve found next year’s budget conversation. With no usable backup at all, you’re into data recovery, a much worse day than a restore.

The one person who knows everything

In a lot of small offices, one person holds the admin passwords, knows the vendor reps, and remembers which box under the desk is the server. If that person is out sick, on vacation, or gone for good, Part 1 should already say who steps in. Give at least two people emergency access to the company password manager, write down where the admin accounts live, and have the backup person do the monthly tasks at least once. It’s the cheapest scenario to fix and the easiest one to put off.

Notes for medical and dental, law, and CPA offices

Medical and dental practices

The HIPAA Security Rule’s contingency plan standard already requires a data backup plan, a disaster recovery plan, and an emergency mode operation plan for systems that hold electronic protected health information. Parts 3 through 5 cover much of that, so file the finished plan with your HIPAA documentation. More on our work with medical and dental practices.

Law firms

ABA Formal Opinion 482 (2018) says lawyers “must evaluate in advance storing files electronically” and “should maintain an electronic copy of important documents in an off-site location that is updated regularly,” according to the ABA Journal’s summary. It also says lawyers must take reasonable steps to keep access to funds held in trust, so put your trust account bank contact in Part 6. More on our work with law firms.

CPA and accounting firms

The IRS asks tax professionals to report client data theft to their local IRS stakeholder liaison and says “Speed is critical,” so that contact belongs in Part 6 (IRS). Firms that prepare returns are covered by the FTC Safeguards Rule, and those holding information on 5,000 or more consumers must also keep a written incident response plan. This plan and that one should point to each other. More on our work with CPA and accounting firms.

None of this is legal advice. Your attorney or compliance advisor should confirm what applies to your practice.

The honest tradeoffs

Writing the plan costs mostly time. Living up to it costs money.

  • It doesn’t fix bad backups. A plan tells you who to call. Only a restore test tells you the backups work.
  • Shorter recovery times cost more. Every hour you cut from a recovery target costs something: more frequent backups, spare hardware, a second internet line. Save short targets for systems that earn them.
  • It goes stale. People and vendors change, which is why this template is short.
  • Testing is friction. Nobody wants to give up the hour. Expect the first test to turn up gaps; that’s the point.
  • Printed copies are sensitive. Cell numbers and account numbers on paper belong in a locked drawer, not on a breakroom shelf.
  • It isn’t a security incident plan or an evacuation plan. A data breach needs its own detailed steps, and life safety comes first. This plan should point to both.

Where I have a stake in this

Harmony sells most of what this plan depends on: backups with tested restores, ransomware and data recovery, 24/7 emergency support, and, on some plans, quarterly virtual CIO planning, where we can review a plan like this one with you. So I benefit if you decide it’s worth paying someone to own these pieces.

There’s a less flattering reason, too. If we’re your IT provider, our number sits in your Part 6, and we can quietly become the key person in Part 1. If the only copy of your admin passwords or restore steps lives in our systems, your plan depends on us answering the phone. A good plan still works on the day your provider can’t. Ask any IT provider, us included, to tell you in writing who holds admin access, where the restore steps live, and how long a full restore actually takes.

Frequently asked questions

Why does a small business need a business continuity plan?

Because the decisions you need on a bad day are easier to make on a calm one. A plan settles who’s in charge, how you reach people, and what gets restored first, so nobody improvises while clients are calling. In medical, legal, and tax offices, it also supports duties you already have.

What is the difference between BCP and BCM?

A business continuity plan (BCP) is the document. Business continuity management (BCM) is the ongoing work that keeps it true: an owner, training, testing, and updates when the business changes. NIST’s contingency planning guide treats maintenance as its own step and says the plan “should be a living document that is updated regularly.”

What are the five steps in business continuity planning?

There’s no single official count. Ready.gov’s training uses six steps, and NIST’s guide uses seven. For a small office, five is plenty: figure out what matters most and how long you can go without it, decide how you’ll recover each piece, write it down with names and numbers, test it, and keep it current.

Where to start

You don’t have to finish this in one sitting. Start with Parts 1 and 6, the pages you’ll reach for first on a bad day, and put the test date on the calendar.

If you’d rather not do it alone, we’ll fill in the template with you, or send it as a Word file you can edit. There’s no pressure and no obligation. We provide IT support in Orlando and managed cybersecurity across Central Florida, and a plan like this is a good first conversation. Call us at (407) 720-6540 any time that suits you.

Sources

Our latest posts