Business Continuity Plan: What a BCP for SMEs Must Include
What do we do if nothing works tomorrow morning? A 10-page BCP is all you need.
Business Continuity is not an extensive manual, but an answer to a single question: what do we do if a key system fails tomorrow. For an SME, a well-prepared ten-page document that everyone is familiar with is sufficient.
TL;DR — Key Highlights
- For each critical process, define RTO (how long can we survive) and RPO (how much data can we afford to lose).
- The plan must contain names and phone numbers, not just roles.
- Manual workaround procedures are often the most cost-effective solution.
- An untested plan is merely an assumption.
What the Plan Must Contain
A good BCP starts with a Business Impact Analysis: which processes generate revenue or carry legal obligations and how long they can remain offline. From this, we derive technical goals — RTO and RPO for each system — and only then do we choose solutions.
Next are the scenarios: internet outage, server failure, ransomware, office premises unavailability, or key supplier failure. For each, we document the first three steps, the responsible persons, and workaround procedures.
Why It Pays Off Even for Small Businesses
Smaller companies have fewer reserves, so downtime hits them harder.
- Clients and tenders increasingly require proof of a plan.
- Insurance companies check preparedness when processing claims.
- Clear steps reduce downtime duration by hours.
- The plan reveals dependencies that no one knew existed.
How to Get Started — Recommended Process
- Inventory key processes and their IT dependencies.
- Define RTO and RPO for each process together with management.
- Check if existing solutions meet these goals.
- Write down scenarios, steps, and contacts on one page per scenario.
- Conduct a tabletop exercise and a recovery test once a year.
- Incorporate findings into the plan and update it.
Example RTO and RPO Goals
| Process | RTO | RPO | Workaround Procedure |
|---|---|---|---|
| 4 hours | 1 hour | Mobile access, phone | |
| Invoicing | 24 hours | 24 hours | Manual invoicing, later entry |
| Production System | 4 hours | 15 minutes | Paper work orders |
| File Services | 48 hours | 24 hours | Work from local copies |
Most Common Mistakes
The most frequent mistake is setting an RTO without checking if the existing solution can actually achieve it. A four-hour target with nightly tape backups is not feasible.
Another mistake is keeping the plan exclusively on the server that is subject to the outage. A hard copy must be printed and kept by responsible personnel.
How VitalIT Helps
At VitalIT, we prepare the impact analysis, the plan, and conduct the exercise. See our IT Consulting and IT Infrastructure services.
Related: Ransomware: Recovery Plan and 3-2-1 Backup Strategy.
Frequently Asked Questions (FAQ)
- How long should a BCP be?
- For an SME, 10 to 20 pages is enough; utility is more important than volume.
- Who is responsible for the plan?
- Management approves it, IT prepares the technical part, and process owners handle the business aspect.
- How often should it be updated?
- At least once a year and after every major change to systems or the organization.
- What is a tabletop exercise?
- A tabletop simulation of a scenario where the team reviews steps without actual downtime — inexpensive and very useful.
- Do we need a backup location?
- Rarely. With the cloud and remote work, most scenarios are covered without additional physical premises.