◆ Quick answer
A business continuity plan template should include a business impact analysis with MTD, RTO and RPO per process, a criticality tier for each process, dependencies with their recovery times and any gaps, a threat risk assessment, timed recovery procedures, emergency contacts, a test and exercise log with results against targets, an action item tracker and a board report.
Guide vs. template
This guide explains what belongs in the template. The paid template gives you the editable working files so you're not rebuilding from a blank page.
Paid template includes
- ◆ 17-tab Excel workbook: Start Here, Dashboard, Risk Assessment, Business Impact Analysis, Dependency Mapping, Recovery Procedures, Emergency Contacts, Test & Exercise Log, Action Items, Scenario Library, Board Report (Quarterly), four worked examples, Regulatory Reference and Lookups
- ◆ Business Impact Analysis: four criticality tiers set by maximum tolerable downtime (Mission Critical, Essential, Important, Deferrable), an RTO <= MTD check that flags an RTO longer than the MTD in red and an RTO equal to it in amber, and an RPO check against the recovery strategy
- ◆ Dependency Mapping: each dependency's contracted or tested recovery time compared with the process RTO, a gap flag when the dependency recovers slower, single points of failure, and the dependencies shared by two or more processes
- ◆ Risk Assessment: threats scored 5 x 5 for likelihood and impact, a control effectiveness rating that scales inherent risk to residual, and a linked tabletop scenario for each risk
What is this template for?
A business continuity plan template is the working record of what you recover first, how fast, and how you know it works. The useful version starts with a business impact analysis (BIA): for each process, the maximum tolerable downtime (MTD), the recovery time objective (RTO) and the recovery point objective (RPO). It then checks each RTO against the MTD, compares every vendor and system the process depends on with that RTO, times the runbooks, and logs exercises, tests and findings to closure. The FFIEC Business Continuity Management booklet, the examination guidance US bank examiners use, follows the same order: business impact analysis, risk assessment, resilience strategies, the plan, training, exercises and tests, maintenance and board reporting.
◆ Audience
Who needs this.
- ◆ Your bank partner asked for your BIA, evidence of testing in the last 12 months and your open findings.
- ◆ Your plan is a policy document that does not tie critical processes to recovery targets, vendors and test results.
- ◆ You need to run a tabletop exercise and show that its findings were tracked to closure.
- ◆ You report to a board or risk committee and need continuity metrics that reconcile.
◆ Required fields
What every row needs.
The fields that make this template defensible to an auditor, bank partner, or examiner — and what goes in each.
| Field | Why it matters | Example |
|---|---|---|
| Process and owner | The BIA is filled in with the people who run the process, not for them. | Settlement & Reconciliation; owner: Controller |
| Maximum tolerable downtime (MTD) | How long the process can be down before the harm is unacceptable; sets the tier. | MTD 12 hours: Essential (4 to 24 hours). Tiers: Mission Critical under 4 hours, Essential, Important (over 24 up to 72 hours), Deferrable (more than 3 days) |
| RTO and RPO | Recovery targets that protect the MTD; the RTO must be shorter than or equal to the MTD. | RTO 8 hours; RPO 1 hour |
| Dependencies and their recovery times | A process recovers no faster than the slowest thing it depends on. | Bank A: contracted recovery 4 hours against the process RTO of 8 hours; no alternative recorded, so a single point of failure |
| Threat risk scores | Shows which scenarios to exercise first. | Ransomware on production systems: likelihood 4 x impact 5 = inherent 20; control effectiveness 2 gives residual 8.0 (Medium) |
| Recovery procedures | Runbook steps timed against the RTO, with last test date and result. | Platform failover runbook: 57 minutes on paper against a 1-hour RTO; step 3 took 70 minutes in the last test |
| Test and exercise results | Results against targets are the evidence that the plan works. | Failover test: 1.5 hours achieved against a 1-hour RTO, so RTO met = No |
| Action items | Turns findings into tracked fixes with owners and dates. | Fix platform failover; owner: Chief Technology Officer; priority Critical; overdue |
◆ Worked example
Example BIA row (Fernbrook Pay, a fictional payments fintech)
| Process and targets | Payment Processing: MTD 2 hours, RTO 1 hour, RPO zero (synchronous replication), financial impact $250,000 per day. |
|---|---|
| Tier and checks | Mission Critical, because the MTD is under 4 hours. RTO <= MTD: OK. RPO check: OK against a hot standby strategy. |
| Dependency gap | The card processor's contracted recovery time is 4 hours against the 1-hour RTO, so the dependency is flagged as a gap and an action item asks for a shorter contracted RTO or a second processor. |
◆ Implementation roadmap
How to roll this out.
Run a BIA workshop with each function
Owner · Business continuity coordinator with process owners
Output · Processes with MTD, RTO and RPO, a tier for each, and no RTO longer than its MTD
Map dependencies and ask vendors for recovery times in writing
Owner · Process owners and vendor management
Output · Dependency map with gap flags and single points of failure
Score threats and pick the first scenario
Owner · Risk
Output · Risk assessment with residual scores, each linked to a tabletop scenario
Write and time the runbooks
Owner · Technology and operations
Output · Recovery procedures checked against each RTO
Exercise and test, then close the findings
Owner · Business continuity coordinator
Output · Test log with RTO and RPO met, and action items with owners and target dates
Report to the board
Owner · Chief risk officer or executive sponsor
Output · Board report with metrics against targets and decisions requested
◆ Ready to use it?
Download the Business Continuity & Disaster Recovery (BCP/DR) Kit.
Use the guide to understand the structure, or buy the editable template to move faster.
◆ FAQ
Frequently asked questions.
What should a business continuity plan template include? ⌄
A business impact analysis with MTD, RTO and RPO for each process, criticality tiers, dependencies with their recovery times, a threat risk assessment, timed recovery procedures, emergency contacts, a test and exercise log, an action item tracker and board reporting.
What is the difference between BCP and disaster recovery? ⌄
Business continuity covers how the business keeps operating during a disruption. Disaster recovery focuses on restoring technology systems and data. A useful plan connects both: the BIA sets the recovery targets, and the disaster recovery runbooks are timed against them.
How often should a BCP be tested? ⌄
The FFIEC Business Continuity Management booklet sets no fixed frequency; it says your exercise and test policy should establish the minimum frequency, scope and reporting. Entities covered by the New York State Department of Financial Services (NYDFS) cybersecurity regulation must test their incident response and business continuity and disaster recovery plans, including restoring from backups, at least annually (23 NYCRR 500.16(d)). Many programs test at least annually and after material changes to processes, technology or vendors.
Why tier processes by MTD instead of RTO? ⌄
The MTD reflects the harm of downtime; the RTO is a target set to stay inside it. Tiering by RTO lets an ambitious target promote a process that could in fact wait. The National Institute of Standards and Technology contingency planning guide (NIST SP 800-34 Rev. 1) states that the RTO must normally be shorter than the MTD.