A business continuity plan answers one question: if something stopped your business tomorrow, how would you keep serving customers, paying people and meeting obligations until things are back to normal? Fires, floods, earthquakes, ransomware, a key supplier's failure or the sudden loss of a key person can all interrupt operations. Insurance can replace some of the money lost; a plan protects customers, staff and reputation, and often shortens the interruption. This guide walks through a practical planning process for small and mid-sized businesses and shows how insurance fits in.
Continuity planning in four parts
Ready.gov, the federal preparedness program, describes business continuity planning as four connected activities. They work for a ten-person firm as well as a large one; the difference is how formal the documents are.
1. Business impact analysis
Identify time-sensitive and critical processes and the consequences of interrupting them.
2. Recovery strategies
Identify the resources needed to restore those processes, compare them with what you have, and choose options.
3. Plan development
Write the plan: recovery teams, relocation, continuity and IT recovery procedures, and manual workarounds.
4. Testing and exercises
Train the team, run exercises, record results and update the plan with lessons learned.
Ready.gov pairs this with a risk assessment, which identifies the hazards most likely to affect you, and risk mitigation, which reduces their impact before they happen.
Step 1: Run a business impact analysis
A business impact analysis (BIA) looks at what you do, not what might happen to you. For each important process, such as taking orders, production, shipping, billing, payroll and customer service, ask:
- What does this process depend on: people, equipment, facilities, software, data, suppliers, utilities?
- How long can it be down before it causes serious harm? Hours, days or weeks?
- What does each day of downtime cost in lost revenue, extra expense, contract penalties and customer loss?
- Are there legal, regulatory or contractual deadlines that continue during a disruption?
- How much data can you afford to lose: the last hour, the last day, the last week?
Two targets come out of this work. The recovery time objective is how quickly a process must be restored. The recovery point objective is how much recent data you can afford to lose, which drives your backup frequency. Ready.gov recommends gathering this information through a questionnaire completed by managers, followed by interviews to fill gaps.
Start with the money. The cost-per-day figure from your BIA is also the starting point for setting business income insurance limits. Many businesses discover their limit was set years ago and no longer matches revenue or expenses.
Step 2: Assess the risks you actually face
List the hazards that could trigger your plan, and rank them by likelihood and impact. For a Puget Sound business the list often includes:
| Hazard | Typical impact | Planning focus |
|---|---|---|
| Fire | Loss of building, equipment and inventory; weeks to months of downtime | Alternate location, equipment lead times, off-site records |
| Earthquake | Building damage, utility and transportation disruption across the region | Staff safety, communications, structural review, earthquake coverage |
| Flood and water damage | Damaged ground floors, inventory and electrical systems | Elevation of critical equipment, flood coverage |
| Severe winter weather and power outages | Closures, frozen pipes, spoilage | Generators, remote work, pipe protection |
| Cyber attack or IT failure | Systems and data unavailable, possible data breach | Backups, incident response plan, cyber insurance |
| Supplier or customer failure | Inputs unavailable or revenue concentrated in one account | Alternate suppliers, contingent business income |
| Loss of a key person | Lost relationships, decisions and know-how | Cross-training, succession plan, key person coverage |
Step 3: Choose recovery strategies
Match each critical process to a realistic way to restore it within its recovery time objective.
- People: cross-train for every critical role; keep an up-to-date contact tree; decide who can authorize spending in an emergency.
- Facilities: identify an alternate site, a sister location, a reciprocal agreement with another business, or remote work for roles that allow it.
- Equipment: know lead times for critical machines and vehicles; line up rental sources and dealers in advance.
- Technology and data: follow a backup approach that keeps copies off site and offline, and test restores. See data backup strategies and incident response planning.
- Suppliers: qualify a second source for critical inputs, and ask key suppliers about their own continuity plans.
- Manual workarounds: paper order forms, offline price lists and manual payroll procedures can keep basic operations going.
Step 4: Write a plan people can use
A continuity plan does not need to be long. It needs to be findable, current and clear under stress.
- Who declares an emergency and activates the plan.
- Recovery team members, alternates and their responsibilities.
- Contact lists for employees, customers, suppliers, landlord, utilities, insurer and broker.
- Step-by-step recovery procedures for each critical process, in priority order.
- Communications: templates for employees, customers and the public.
- Where to find insurance policies, financial records, equipment lists and photos of the premises.
- Copies stored off site and in the cloud, accessible from a phone.
Life safety comes first. Your continuity plan should sit alongside an emergency action plan covering evacuation, shelter and accounting for employees. See emergency preparedness and emergency action plans.
Step 5: Test, train and update
Untested plans tend to fail at the first step, such as an outdated phone list or a backup no one knows how to restore. Ready.gov's process ends with training, exercises, documenting results and updating the plan. In practice:
- Hold a tabletop exercise at least once a year: walk through a scenario and see where the plan breaks.
- Test a data restore, not just the backup job.
- Update contact lists quarterly and after staff changes.
- Review the plan after any real incident, office move, major new customer or new system.
How insurance supports the plan
Insurance is the funding side of continuity. It does not replace planning, and it has waiting periods, limits and exclusions that the plan needs to account for.
| Coverage | What it typically does | Points to check |
|---|---|---|
| Business income | Replaces lost net income and continuing expenses during a closure caused by covered physical damage. Under the standard ISO form, coverage starts 72 hours after the loss. | Limit versus your BIA numbers; waiting period; extended period after repairs (60 days on the standard form) |
| Extra expense | Pays reasonable added costs to avoid or shorten the shutdown, such as a temporary location or rented equipment. No waiting period on the standard form. | Whether it is included with business income or limited separately |
| Civil authority | Limited coverage when authorities prohibit access because of nearby damage, commonly within one mile, starting 72 hours after the order, for up to four weeks. | Distance, duration and waiting period on your form |
| Contingent (dependent property) business income | Covers income lost when a key supplier or customer location suffers covered damage. | Named versus unnamed dependents and sublimits |
| Cyber insurance | Commonly covers incident response, data restoration and income lost from a network outage. | System failure versus attack, and dependent business coverage |
| Equipment breakdown | Covers mechanical and electrical failure that property forms often exclude, often including business income. | Spoilage and utility interruption extensions |
| Key person life insurance | Provides funds to the business if a critical owner or employee dies. | Ownership, beneficiary and federal notice-and-consent rules; ask your tax advisor |
| Flood and earthquake | Separate coverage for perils excluded from standard property forms. | Deductibles; NFIP flood does not cover business interruption |
The commercial property insurance page describes how property and business income coverage fit together. Policy forms and exclusions vary by carrier, and the policy language controls any claim.
When to call a broker
Bring your broker into the process when you complete a BIA, after a major change such as a new facility or a large customer, and at least once a year to compare business income limits against current numbers. As a broker, we compare options across the market and can line up your coverage with your recovery plan, so the policy responds the way the plan expects.
Sources
- Ready.gov — Business preparedness planning
- Ready.gov — Business continuity planning process diagram (text version)
- InsuranceXDate — ISO CP 00 30 Business Income and Extra Expense Coverage Form overview
- PropertyCasualty360 — Contingent business interruption and civil authority coverage overview
- FEMA FloodSmart — NFIP coverage