Business Continuity and Disaster Recovery Policy
- Document ID
- PDC-BCDR-SAMPLE
- Document version
- 1.0
- Template version
- v1.1.1
- Effective date
- October 2, 2026
- Next review
- October 2, 2027
1. Purpose
This policy sets how [Company Name] (the "company") prepares for, responds to, and recovers from events that disrupt normal operations, such as severe weather, fire, flooding, power, internet, or phone outages, cyberattacks, the loss of a key supplier, the loss of key people, or a public health emergency.
Priorities. In every disruption the company acts in this order: first, the safety of people; second, keeping critical business functions running, even in a reduced or manual form; third, restoring everything else in an agreed order; and throughout, communicating clearly with employees, customers, and suppliers.
The policy is designed to follow NIST SP 800-34 Rev. 1 and the Ready.gov business continuity planning process, and to support the company in meeting its legal, regulatory, insurance, and contractual obligations. It does not replace those obligations. Where a law, regulation, or contract sets a stricter requirement, the stricter requirement applies.
2. Scope and Related Plans
This policy applies to all [Company Name] locations, employees, officers, temporary workers, and contractors, and to the facilities, equipment, systems, and suppliers that critical functions depend on.
How the plans fit together. This policy covers the business side of a disruption: people, critical functions, workplaces, communications, and suppliers. It works with two related policies, and it does not repeat them:
- The Data Backup and Recovery Policy sets how systems and data are backed up, protected, tested, and technically restored. Its recovery targets must meet the business targets in this policy.
- The Incident Response Policy sets how cyberattacks and data breaches are contained, investigated, and reported, including legal notification deadlines. When a disruption is caused by a cyberattack, both plans are used together.
Where either related policy has not yet been adopted, the company must still meet the recovery targets in this policy and handle any cyberattack with qualified help.
3. Definitions
- Business continuity
- Keeping critical business functions running, in some form, during and after a disruption.
- Disaster recovery
- Restoring technology systems and data after a disruption, in an agreed order. It is the technical part of business continuity.
- Critical function
- Work that would cause serious harm to customers, cash flow, legal standing, or reputation if it stopped for longer than its recovery time objective.
- Business impact analysis (BIA)
- A short review of each business function that asks what happens if it stops, how quickly the harm grows, and what it depends on. It is used to rank functions and set recovery targets.
- Recovery time objective (RTO)
- The longest a function or system can be unavailable before the harm becomes serious. In plain words: how fast it must be working again.
- Recovery point objective (RPO)
- The most recent work, measured in time, the company can afford to lose and re-enter. In plain words: how much data loss is acceptable.
- Crisis team
- The small group of leaders who make decisions and coordinate the response during a disruption.
- Call tree
- A list that assigns each leader a few people to contact in an emergency, so everyone is reached quickly and no one is missed.
- Tabletop exercise
- A guided discussion in which the crisis team walks through a realistic scenario step by step to test whether the plan works, without disrupting real operations.
- Alternate work arrangement
- A planned way for work to continue when the normal workplace or systems are unavailable, such as remote work, another site, or a manual process.
4. Roles and Responsibilities
| Role | Responsibilities |
|---|---|
| Executive sponsor (Chief Executive Officer) | Approves this policy, the recovery targets, and the budget to meet them. Leads the crisis team, declares a disruption, and approves major decisions such as relocating operations. |
| Continuity coordinator (Operations Manager) | Maintains the plan and contact lists, runs the business impact analysis and exercises, coordinates the response during a disruption, and keeps the decision log. |
| Crisis team | The executive sponsor, the continuity coordinator, and the leaders of operations, finance, human resources, IT, and sales or customer service. Makes and communicates decisions during a disruption. |
| Function owners | The manager of each critical function. Keeps that function's dependencies, workarounds, and recovery steps current, and leads its recovery. |
| IT lead or IT service provider | Recovers systems and data under the Data Backup and Recovery Policy, provides remote access and equipment for alternate work, and leads the technical response to cyberattacks under the Incident Response Policy. |
| All personnel | Keep their emergency contact details current, know how they will be contacted, follow instructions during a disruption, and report hazards and outages immediately. |
Backups for key people. Every role above, and every person who alone knows how to do a critical task, has a named and trained backup. Authority to approve payments and payroll is delegated in writing to at least two people, so that money can still move safely when one person is unavailable.
5. Business Impact Analysis and Critical Functions
The continuity coordinator leads a business impact analysis with each function owner at least once a year and after any major change to the business. [Company Name] has identified the following critical functions:
| Critical function | Key dependencies | Must resume within |
|---|---|---|
| Taking and confirming customer orders | Order entry system or ERP, phones and email, price lists, customer records | 24 hours |
| Production or delivering the service customers pay for | Skilled staff, equipment and machine programs, materials, work instructions, quality records | 24 hours |
| Billing, collections and paying suppliers | Accounting system, bank access with multi-factor authentication, approval process, invoices | 24 hours |
| Paying employees | Payroll provider or system, time records, bank access, an approved backup approver | 24 hours |
| Answering customers and the main phone line | Phone system or call forwarding, email, customer and order records | 24 hours |
Dependencies. For each critical function, the function owner records the people and skills, systems and data, equipment, facilities, suppliers, and service providers it needs, and the minimum level of each needed to keep working in a reduced form.
Everything else. Functions not listed as critical are restored after critical functions, in the order the crisis team decides, normally within 10 business days.
6. Recovery Objectives in Plain Words
| Target | What it means | [Company Name] target |
|---|---|---|
| Recovery time objective (RTO) | How fast critical functions must be working again, even if only by a manual workaround. | 24 hours |
| Recovery point objective (RPO) | The most recent work the company can afford to lose and re-enter after systems are restored. | 4 hours |
Meeting the targets. Critical functions may meet the recovery time target through an alternate work arrangement while systems are still being restored. The systems critical functions depend on must be backed up often enough that no more than 4 hours of work is lost, and the recovery targets for those systems in the Data Backup and Recovery Policy must be consistent with this policy: either the system is restored within 24 hours, or a documented workaround keeps the function running until it is.
Targets that cannot be met. If an exercise or a real event shows a target cannot be met, the continuity coordinator records the gap and a plan to close it, and the Chief Executive Officer either approves the resources or accepts the risk in writing.
7. Activating the Plan: the First Hours
Who decides. The Chief Executive Officer, or the continuity coordinator when the Chief Executive Officer cannot be reached within 30 minutes, decides when an event is a disruption under this policy and activates the plan. Any employee may call emergency services first when people are in danger.
First steps. When the plan is activated, the crisis team works through these steps:
- Make sure everyone is safe. Follow evacuation and shelter procedures, call 911 when needed, and account for every person on site.
- Assess the situation: what is affected, what still works, and how long the disruption is likely to last.
- Convene the crisis team using the communication methods in this policy, and start a written log of decisions and their times.
- If a cyberattack is suspected, activate the Incident Response Policy at the same time, and do not restore or rebuild systems until the incident response lead agrees.
- Decide which critical functions move to alternate work arrangements and who does what.
- Notify employees, then customers, suppliers, the insurance carrier, and other stakeholders, using the communication plan.
- Review progress against the recovery targets at least every few hours, and adjust the plan as facts change.
8. Alternate Work Arrangements
| Arrangement | How it works |
|---|---|
| Work from home | Personnel whose jobs allow it work remotely on company laptops, using secure remote access and the company cloud email and file services. Managers keep a list of who can work remotely and what equipment they need. |
| Manual workarounds | Each function owner documents how the work continues on paper or by phone while systems are down, such as printed order forms, pick lists, and time sheets, and how that work is entered once systems return. |
Internet and phones. The main site has a backup internet connection from a second provider or a cellular service that takes over automatically. The main phone number can be forwarded to mobile phones or answered from home.
Power. Battery backup protects network equipment and servers so they ride through short outages and shut down safely during long ones. Batteries are tested and replaced on the manufacturer's schedule.
Equipment and security. Company laptops used for alternate work must be managed and protected like any other company device. Personnel must not move company data to personal accounts or unapproved devices during a disruption, because attackers often take advantage of the confusion.
9. Communication Plan and Call Tree
Reaching employees. The company uses the following methods to reach employees in a disruption:
- A phone call tree, in which each leader calls a short, assigned list of people and reports back who could not be reached.
- An emergency text and voice alert service that reaches every employee at once on their personal phone.
Contact lists. The continuity coordinator keeps a current emergency contact list with personal phone numbers for all personnel, and contacts for key customers, suppliers, service providers, the landlord, utilities, the bank, the insurance carrier and agent, and legal counsel. Personal contact details are confidential and used only for emergencies.
Who says what. Only the Chief Executive Officer or a person they designate speaks for the company to customers, the media, and the public. Messages should say what happened in plain terms, what customers can expect, and when the next update will come. Do not guess about causes, especially in a suspected cyberattack, where statements must be reviewed under the Incident Response Policy. This does not limit the Protected Reports section.
| Audience | When | Who |
|---|---|---|
| Employees | As soon as the plan is activated, then at least daily | Continuity coordinator |
| Key customers | Within the first business day | Sales or customer service leader |
| Key suppliers and service providers | As soon as orders or deliveries are affected | Purchasing or operations leader |
| Insurance carrier and agent | As soon as possible, within any deadline in the policy | Finance leader |
| Bank and lenders | When payments or covenants may be affected | Finance leader |
Questions. Personnel who cannot reach their manager during a disruption contact the IT Manager or follow the instructions in the most recent emergency message.
10. Key Suppliers and Service Providers
As part of the business impact analysis, each function owner identifies the suppliers and service providers that a critical function cannot operate without, such as key material suppliers, carriers, the internet and phone providers, the payroll provider, and the IT service provider. For each one, the function owner records:
- Emergency contact details and account numbers.
- Whether an approved alternate supplier exists, and how quickly it could be used.
- Any continuity or recovery commitments in the contract, and whether the supplier can show it has its own tested plan.
- How long the company could operate on its own stock or workarounds if the supplier stopped.
Where a single supplier could stop a critical function and no alternate exists, the continuity coordinator reports the risk to the Chief Executive Officer with options, such as an alternate supplier, extra stock, or a contract change.
11. Common Scenarios
| Scenario | First actions |
|---|---|
| Hurricane, flood, or winter storm | Watch official forecasts, protect equipment and records before the storm, move to remote or alternate work, and check on every employee afterward. |
| Fire or loss of the building | Evacuate and account for everyone, activate alternate work, contact the insurance carrier and landlord, and start replacing equipment. |
| Power, internet, or phone outage | Switch to backup power and internet if available, forward the main phone number, and use manual workarounds for critical functions. |
| Cyberattack or ransomware | Disconnect affected devices as instructed, activate the Incident Response Policy, use manual workarounds, and restore systems only when the incident response lead agrees. |
| Loss of data or a key system | Recover under the Data Backup and Recovery Policy while critical functions use workarounds. |
| Key supplier or service provider failure | Contact the supplier, switch to the approved alternate, and tell affected customers early. |
| Key person unavailable, or many people out sick | The named backup takes over, cross-trained staff cover critical functions, and non-critical work pauses. |
12. Testing and Exercises
Tabletop exercise. The continuity coordinator runs a tabletop exercise with the crisis team at least once a year. Each exercise uses a realistic scenario, such as a hurricane, a ransomware attack, a building fire, or the loss of a key supplier, and rotates scenarios from year to year. The exercise checks that people know their roles, that contact lists and workarounds are current, and that the recovery targets are realistic.
Communication test. The call tree or alert system is tested every six months, recording how many people were reached and how long it took. Wrong or missing contact details are fixed within one week.
Technical recovery tests. Restore tests and technical disaster recovery exercises are run under the Data Backup and Recovery Policy, and their results are reviewed at the tabletop exercise.
Lessons learned. After every exercise and every real disruption, the continuity coordinator writes a short summary of what worked, what did not, and the corrective actions, each with an owner and a due date, and reports it to the Chief Executive Officer.
13. Plan Maintenance and Storage
Where the plan is kept. The current plan, contact lists, and key documents are kept where the crisis team can reach them without company systems: a printed copy in a secure, known location, and an electronic copy in storage that does not depend on company accounts or the company network. Each crisis team member knows how to reach both.
When the plan is updated. The plan is updated after every exercise or real disruption, and whenever the business changes in a way that affects it, such as a new location, a new critical system or supplier, a change of IT provider, or a change in key people.
Insurance. The Chief Executive Officer reviews property, business interruption, and cyber insurance coverage against the plan at least once a year, so that coverage reflects the real cost of a disruption.
14. Regulated Data Requirements
Regulated information must stay protected during a disruption, when normal controls may be bypassed. The following additional rules apply:
Personal and confidential information. Paper records, laptops, and drives moved during a disruption are kept secured and logged. Printed workarounds that contain personal or confidential information are collected and shredded once systems return. A suspected loss of personal information is handled under the Incident Response Policy, because breach notification laws may apply.
15. Exceptions, Enforcement and Review
Exceptions. Requests for an exception, for example a critical function that cannot meet its recovery target yet, are made in writing to the IT Manager. Exceptions are approved by the Chief Executive Officer, recorded with a plan to close the gap, and limited to 12 months.
Expectations. Personnel are expected to keep emergency contact details current, take part in exercises when asked, and follow the plan during a disruption. Deliberately ignoring the plan, or bypassing security controls during a disruption without approval, may result in disciplinary action consistent with applicable law.
Policy review. The IT Manager reviews this policy no later than October 2, 2027, and sooner after a real disruption, an exercise that shows a gap, or a significant change to the business.
17. Protected Reports
Nothing in this document prohibits or restricts anyone from reporting a possible violation of law to, filing a charge or complaint with, communicating with, or taking part in an investigation by any government agency, including law enforcement, the U.S. Department of Health and Human Services, the Securities and Exchange Commission, the National Labor Relations Board, or a state attorney general, or from making any other disclosure protected by law. No approval is needed for these reports, and no one will be disciplined for making one in good faith.
18. Document Control and Revision History
| Field | Value |
|---|---|
| Status | Draft generated from a template. Not in effect until reviewed by your legal counsel and approved and signed below. |
| Document | Business Continuity and Disaster Recovery Policy |
| Organization | [Company Name] |
| Document ID | PDC-BCDR-SAMPLE |
| Document version | 1.0 |
| Effective date | October 2, 2026 |
| Next scheduled review | October 2, 2027 |
| Policy owner | IT Manager |
| Approver (title) | Chief Executive Officer |
| Source template | Preferred Data Corporation Business Continuity Policy template v1.1.1 |
| Template content last reviewed | October 2, 2026 |
Approval. Sign below to approve this document for adoption by [Company Name] after it has been reviewed by your legal counsel. Until it is signed, it is a draft and is not in effect.
Name
Title
Signature
Date
Revision history. Record every change to this policy below. Increase the document version and obtain approval again each time the policy is revised.
| Version | Date | Description of change | Approved by |
|---|---|---|---|
| 1.0 | October 2, 2026 | Draft generated from template v1.1.1; pending legal review and approval | Blank |
| Blank | Blank | Blank | Blank |
| Blank | Blank | Blank | Blank |
19. Template Notice and Legal Disclaimer
This document was generated from a starter template provided by Preferred Data Corporation. It is general information only. It is not legal advice and it is not a substitute for advice from a licensed attorney. Using the template does not create an attorney-client, consulting, or other professional relationship.
Preferred Data Corporation is not a law firm or an insurer. It makes no representation that this document is complete, current, or suitable for any particular organization, industry, jurisdiction, or regulatory requirement. To the fullest extent permitted by law, it is not responsible or liable for any loss or damage arising from the use of this template or of any policy created from it. You are solely responsible for how you adapt, adopt, and enforce it.
Laws, regulations, insurance requirements, and contracts that apply to your organization may require different or additional terms. The facts, deadlines, and legal references in this template were checked against their sources on the date shown as "Template content last reviewed" in Document Control, not on the effective date, and may have changed since. Before you adopt, publish, or rely on this document, and in every case where you have a legal, regulatory, or contractual obligation, have it reviewed by qualified legal counsel.
In an actual security incident or data breach, contact your attorney, your cyber insurer, and law enforcement where appropriate. Do not rely on this template alone to decide whether, when, or how to notify anyone.
If Preferred Data Corporation prepared this document for you as part of its services, your service agreement governs those services. The content of this document is still general information and should be reviewed by your own counsel before you adopt it.
This template is provided "as is", without warranties of any kind, including accuracy, completeness, or fitness for a particular purpose. Links to laws, agencies, and other websites are provided for convenience and may change. Use of this template is also subject to the Website and Free Resources Disclaimer and the Terms of Service at preferreddata.com/legal/disclaimer and preferreddata.com/legal/terms-of-service.
To report an error, contact Preferred Data Corporation at preferreddata.com/contact or (336) 886-3282 and include the Document ID shown in Document Control. Corrections are listed in the template changelog on the template's page at preferreddata.com/policy-templates.
