What Should an ISO 22301 Business Continuity Plan Template Include?
Last Updated: October 26, 2026
Quick Summary
An ISO 22301 business continuity plan template must contain governance, a business impact analysis, risk assessment, recovery strategies, and incident response, with each section mapped to ISO 22301:2019 clauses 4 through 10. Every template also needs scope and context, policy and objectives, roles and responsibilities, plans and procedures, and testing, review, and improvement.
- Each template section should trace to an ISO 22301:2019 clause so auditors can check completeness.
- The BIA rates the impact of losing each activity over hours, a day, or a week.
- Set recovery time and recovery point objectives per activity, not per company.
- Test quarterly with walkthroughs, twice a year with tabletop exercises, and annually with a full simulation.
- A short, complete plan beats a long, half-finished one every time.
Table of Contents
- What an ISO 22301 Business Continuity Plan Template Must Contain
- Business Continuity Plan Requirements: The Mandatory Elements
- How to Complete a Business Impact Analysis Template
- Business Continuity Plan Examples: A Worked Disruption Scenario
- Building Your Business Continuity Testing and Exercise Schedule
- Adapting the Template for Small Teams and Specific Sectors
- Download the ISO 22301 Documentation Toolkit
- Frequently Asked Questions
What an ISO 22301 Business Continuity Plan Template Must Contain
A strong ISO 22301 business continuity plan template turns a vague promise to "stay open" into documented, testable steps. At Compliance Toolkits, we build these templates for real audits, not shelfware. The core sections cover governance, a business impact analysis, risk assessment, recovery strategies, and incident response. Miss one and your certification audit will find it.
The standard behind this is ISO 22301:2019, the international benchmark for a business continuity management system (BCMS). It follows the same high-level structure as other ISO management standards, so the documents slot into a wider compliance program. That matters if you already run ISO 27001.
Every template needs these parts:
- Scope and context: what the BCMS covers and who it protects
- Policy and objectives: leadership's written commitment
- Roles and responsibilities: who does what during a disruption
- Business impact analysis (BIA): which activities matter most
- Risk assessment: what could disrupt them
- Continuity and recovery strategies: how you respond and restore service
- Plans and procedures: the step-by-step playbooks
- Testing, review, and improvement: proof the plan works
The ISO 22301 standard overview sets the requirements these documents must meet.
Clause-by-Clause Mapping to ISO 22301:2019
Each template section should trace to a clause. This is how auditors check completeness.
| Template Section | ISO 22301:2019 Clause |
|---|---|
| Scope, context, interested parties | 4 |
| Leadership, policy, roles | 5 |
| Risk assessment, objectives, planning | 6 |
| BIA, strategies, plans, procedures | 8 |
| Testing, measurement, internal audit | 9 |
| Corrective action, continual improvement | 10 |
If you already run an information security system, our guide on ISO 27001 and ISO 22301 alignment shows where the two overlap while you map clauses.
Business Continuity Plan Requirements: The Mandatory Elements
What does an auditor actually look for? Documented evidence that you identified your critical activities, set recovery targets, and can prove the plan works. The mandatory elements are non-negotiable, and each needs a named owner and a review date.
A common mistake is writing a thick manual nobody reads. Auditors care less about length and more about traceability. Can you show the link from a critical activity to a recovery strategy to a test result? That chain is the point.
Your plan must include:
- A communication plan covering staff, stakeholders, suppliers, and customers
- Escalation paths and a named incident response team
- Recovery procedures for each critical process
- A test schedule with recorded outcomes
The FEMA business continuity guidance offers a plain-language starting point for the operational side.
How to Complete a Business Impact Analysis Template
A business impact analysis template captures which activities keep the business running and what happens when each stops. The BIA is the backbone of the whole plan. Get it right and everything downstream, from recovery priorities to strategy, falls into place. For guidance on customizing compliance templates for audits, see our How to Customize Compliance Templates for Audits article.
Work through it in this order:
- List every business activity and who owns it.
- Rate the impact of losing each one over time: hours, a day, a week.
- Identify the resources each activity depends on: people, systems, suppliers, facilities.
- Set recovery priorities based on impact.
- Record dependencies between activities so you see the knock-on effects.
Setting Recovery Time and Recovery Point Objectives
Two numbers drive your recovery strategy. The recovery time objective (RTO) is how long an activity can be down before the impact becomes unacceptable. The recovery point objective (RPO) is how much data you can afford to lose, measured in time.
A payment system might need an RTO of four hours and an RPO of fifteen minutes. A back-office reporting tool might tolerate a day. Set these per activity, not per company. Then check that your recovery strategy and dependencies can actually meet them. If they can't, you have found your gap before an auditor does.
Business Continuity Plan Examples: A Worked Disruption Scenario
Picture a mid-market firm whose primary supplier suffers a ransomware attack. Orders stall, the call center fills with complaints, and nobody knows who decides what. Here is how the plan should run, and what the filled-in fields look like at each step.
Scenario: Primary order-fulfillment supplier is offline after a ransomware attack. Estimated outage: unknown at activation, assumed 72 hours for planning.
Step 1, Activation. The incident response team lead confirms the disruption against the activation criteria in the plan (supplier outage exceeding four hours during business hours). The plan is activated at 09:15. This initial assessment phase also provides a critical opportunity for identifying coverage gaps that might otherwise remain hidden until the financial impact of the disruption becomes unavoidable.
ISO 22301 Documentation Toolkit →
Step 2, Escalation. The escalation path notifies leadership within the agreed 30-minute window. The named incident commander is the operations director; the backup is the finance director. Both names, mobile numbers, and backup contacts are in the contact list, which is checked quarterly.
Step 3, Communication. The communication plan sends holding messages to customers and staff. Pre-approved templates exist for three audiences: customers (order delay notice), staff (internal status update), and regulators where notification is required. The communications lead owns distribution and the log.
Step 4, Continuity strategy. Because the BIA flagged the supplier dependency and rated order fulfillment as a critical activity with an RTO of 24 hours, a pre-approved alternate provider takes over. The alternate provider agreement, signed and reviewed annually, specifies onboarding within 12 hours.
Step 5, Recovery. Recovery procedures restore the ordering system to its RTO. The RPO for order data is 15 minutes, met by the replication setup documented in the recovery procedure. The procedure lists the sequence, the responsible role for each step, and the verification check before the system is declared restored.
Step 6, Stand-down and review. Afterward, the team logs what happened: activation time, escalation time, communication times, recovery time against RTO, and what failed. Findings feed the corrective action log and the next risk assessment review.
Here is what the filled-in fields look like for the critical activity in this scenario:
| Field | Example Entry |
|---|---|
| Critical activity | Order fulfillment |
| Activity owner | Operations director |
| Impact over time | 4 hours: minor delay; 24 hours: customer penalties; 72 hours: contractual breach |
| RTO | 24 hours |
| RPO | 15 minutes |
| Minimum service level | 60% of orders processed within 48 hours |
| Dependencies | Primary supplier, ordering system, payment gateway, warehouse staff |
| Continuity strategy | Alternate supplier agreement; manual order intake procedure |
| Recovery procedure reference | OP-04 Order Fulfillment Recovery |
| Last test date and result | Tabletop, 14 months ago, two gaps found, both closed |
This is the difference between a plan and a document. A plan names the people, the order of steps, the fallback options, and the numbers that define success. A document says "we will respond appropriately." Our Business Resilience Toolkit extends this scenario thinking across disruptions, crises, and operational risks.
Building Your Business Continuity Testing and Exercise Schedule
A plan you never test is a guess. Testing turns assumptions into evidence, and auditors want to see both the schedule and the results. Build a yearly cycle that mixes small checks with full exercises.
- Quarterly: walkthroughs and contact-list checks
- Twice a year: tabletop exercises for the incident team
- Annually: a full simulation of a critical scenario
- After every test: log findings and assign corrective actions
Record the date, the scenario, who took part, what failed, and what changed as a result. Our Testing Toolkit provides practical templates to run and document continuity exercises. That record is your proof of continual improvement.
Adapting the Template for Small Teams and Specific Sectors
A five-person team does not need a hundred-page manual. It needs the same logic in a leaner package. Scale the BIA to your key activities, keep one incident team with clear backups, and test what you can with the people you have.
Sector shifts the emphasis. Healthcare leans on patient-facing continuity and privacy rules. Financial institutions tie continuity to regulatory expectations and audit trails. Technology firms weight cyber and supplier risk heavily. The structure stays the same; the scenarios and dependencies change. Our Business Resilience Toolkit extends this approach across sectors and operational risks.
Watch out: the most common failure is copying an enterprise template wholesale and leaving sections blank. A short, complete plan beats a long, half-finished one every time.
Download the ISO 22301 Documentation Toolkit
You do not have to build this from scratch. Our ISO 22301 Documentation Toolkit is a complete, audit-ready documentation system designed to help organizations and consultants implement, operate, and certify a Business Continuity Management System (BCMS) aligned with ISO 22301:2019. It covers BCMS governance and scope, context of the organisation and interested parties, Business Impact Analysis (BIA) and risk assessment, business continuity strategies and solutions, incident response and crisis management, business continuity plans and recovery procedures, exercising, testing, and performance evaluation, internal audits, management review, and continual improvement. All documents are mapped to ISO 22301:2019 clauses (4-10). Every template is structured to support business impact analysis, risk assessment, continuity strategies, incident response, testing, audit traceability, and continual improvement. Every document is fully editable, so you customize it for your organization or your clients.
It is a one-time digital download with no software, no subscription, and no vendor lock-in. Small teams use it as-is; consultants reuse it across engagements.
Frequently Asked Questions
What should an ISO 22301 business continuity plan include?
A compliant plan covers BCMS scope and governance, a business impact analysis with recovery time and recovery point objectives, risk assessment and threat identification, continuity and recovery strategies, incident response and crisis management roles, a communication plan for stakeholders and suppliers, and testing and maintenance procedures. Every section should map to ISO 22301:2019 clauses 4 through 10 so an auditor can trace documented information back to the standard. A template that skips the BIA or the exercise schedule will fail a certification audit.
Can a business continuity plan template be used for ISO 22301 certification?
Yes, provided the template is built around the standard's clause structure and you customize it to your organization. Auditors check that documented information reflects your actual critical activities, dependencies, and recovery objectives, not generic text. Start with a template that includes the BIA procedure, risk assessment, continuity strategies, and exercise records, then replace sample data with your own. A template gives you the framework; your evidence makes it certifiable.
How often should a business continuity plan be tested?
ISO 22301 requires a planned exercise program rather than a single annual test. Most certified organizations run at least one full plan activation exercise per year, plus smaller tabletop exercises quarterly and technical recovery tests for critical systems. Build a business continuity testing and exercise schedule that names the scenario, participants, and success criteria for each exercise, then log results and corrective actions. Review the schedule at every management review to keep it current.
What is the difference between a business continuity plan and a disaster recovery plan?
A business continuity plan covers the whole organization: critical activities, people, suppliers, facilities, and communications during a disruption. A disaster recovery plan focuses narrowly on restoring IT systems and data after an outage. ISO 22301 expects the BCP to set recovery priorities and objectives, with disaster recovery as one supporting strategy within it. Keep the DR plan as an annex to the BCP so recovery time objectives stay consistent across both documents.
Building a BCMS that survives a real disruption and a strict auditor is hard work. Compliance Toolkits makes it faster with practitioner-designed, fully editable documentation you can tailor to your organization. Get started with Compliance Toolkits and turn your continuity plan into audit-ready proof.
