Most continuity plans fail at the exact moment they are needed, because they were written to be filed rather than used. A useful business continuity plan lets whoever opens it on a bad morning — possibly not you — work out in under two minutes what to restore first, who to call, and what can safely wait until Thursday. You can build a workable version in a blank spreadsheet in about three focused hours. Here is the sequence.
What a Business Continuity Plan Has to Answer on a Bad Day
Skip the template language and hold your plan to four questions, in this order:
- What must keep running? The handful of activities that cost you money, break a contract, or miss a legal deadline if they stop.
- What does each one depend on? People, accounts, data, vendors, hardware, connectivity.
- In what order do you restore? Ranked in advance, so nobody negotiates priorities mid-incident.
- Who do you call, and what is the workaround until the real fix lands?
There is a fifth requirement most plans skip: it has to be readable when the thing that broke is the place you stored it. If the plan lives only in the cloud drive that is down or the laptop that was stolen, you do not have a plan. Print it. Keep a PDF copy on two phones.
Step 1: List Critical Functions, Not Departments or Job Titles
Open a sheet named Functions. Write each row as a verb phrase describing work that happens: „invoice clients,“ „pay contractors,“ „deliver approved client files,“ „answer support email,“ „run payroll,“ „accept card payments,“ „access signed contracts.“
Then apply one test to each row. If this stopped for five business days, would you lose revenue, break a contractual commitment, miss a filing or payment deadline, or damage a client relationship you cannot repair? If the answer is no on all four, it is not critical. Move it to a second tab and stop thinking about it.
Most solo operators and small teams land on eight to fifteen critical functions. If you have forty, you are listing tasks, not functions. Columns for this sheet: function, owner, backup owner, why it matters, maximum tolerable downtime, tier.
Step 2: Map Dependencies Until You Hit Something You Do Not Control
On a Dependencies sheet, give every function its own block and push each chain one level further than feels necessary. Use four buckets: people, accounts and tools, data, and outside parties.
Worked through, „invoice clients“ rarely stops at your invoicing app. It depends on the app, which depends on your email for password resets, which depends on a two-factor code on one specific phone, which depends on that phone being charged and in the country. It also depends on your bank account being open and on the client’s portal accepting uploads.
Add a column called single point of failure and mark it yes when exactly one person holds the credential, one device receives the codes, or one vendor has no substitute. Those yes rows are your actual to-do list. Fixing three of them this month beats writing forty more pages.
Step 3: Set Recovery Priorities With One Decision Rule
Priorities argued about during an outage are priorities you do not have. Assign every function a maximum tolerable downtime — the point at which the damage becomes hard to undo — then tier it with this rule:
- Tier 1: something irreversible happens within 24 hours. Missed payroll, a missed statutory or filing deadline, a contract penalty clause, anything affecting safety.
- Tier 2: real damage accumulates within 72 hours. Sales stall, support queues overflow, delivery slips.
- Tier 3: a week or more of downtime is survivable. Reporting, internal projects, content.
Cap Tier 1 at three functions for a team under ten people. The cap is the whole point. If everything is Tier 1, you have a wish list. Sort the sheet by tier, and that sorted order is your restoration sequence.
Step 4: Contacts and Alternatives That Work Without Your Laptop
A Contacts sheet needs role, name, mobile number, a personal email outside your company domain, account or policy number, backup contact, and who on your side makes the call. Include your bank, payment processor, insurance broker, payroll provider, accountant, landlord or coworking manager, IT or web host, and your top five clients.
Then an Alternatives sheet: for each Tier 1 and Tier 2 function, the manual workaround. Invoice from a saved PDF template with bank transfer details. Forward support to a personal phone. Tether to a mobile hotspot. Take deposits by transfer while the card reader is dead.
Every workaround must be tested once before it appears on this sheet. An untested workaround is a guess written in a confident font.
A Worked Example: A Three-Person Design Studio
Function: deliver approved client files by the contracted date. Maximum tolerable downtime: 48 hours, because the master services agreement has a late-delivery credit. Tier 1.
Dependency chain: design tool, founder’s Google account, founder’s phone for two-factor codes, office fiber, signed contracts stored in the founder’s inbox, project backups in the same Google account as the originals.
Single points of failure found: one admin on the design tool, contracts in one mailbox, backups in the same account as the primary files. Three fixes with owners and dates: add a second admin and a shared password vault (founder, by Friday); copy signed contracts to a second provider (Marco, this week); weekly export of active project files to an external drive kept off-site (Marco, Fridays at 4 p.m.).
Two weeks later the building lost fiber for a day. They worked from hotspots and delivered on time, but discovered the hotspot plan throttled hard after a few gigabytes of uploads. That went on the lessons-learned sheet with a fix, an owner, and a date — which is exactly what a real drill is for.
Run One Exercise a Quarter, Then Record What Broke
Book 45 minutes. Pick one scenario: your primary laptop is gone; your email account is locked; your payment processor holds funds for ten days; a key person is unreachable for two weeks; the office is inaccessible.
One rule makes the exercise worth doing: it does not end when someone describes the workaround. It ends when someone performs it. Actually sign in with the backup admin. Actually restore one file from the backup. A backup you have never restored from is a hypothesis.
Log results on a Lessons Learned sheet: date, scenario, what failed, fix, owner, due date, verified date. Any row without an owner and a date is decoration.
Where a Spreadsheet Stops Being Enough
Be honest about the ceiling. A business continuity plan in a spreadsheet handles single-site, small-team operational interruptions well. It stops being sufficient when:
- A breach involves personal data. Notification duties vary by state and by contract. That is a call to counsel and your insurer, not a tab.
- You handle regulated or cardholder data, or a client contract requires tested recovery objectives with evidence. That needs real infrastructure and audit trails.
- You pass roughly 25 people or a second location. Version control in shared files breaks quietly and nobody notices until the drill.
- You need someone woken up at 3 a.m. A spreadsheet cannot page anyone. That is on-call tooling.
None of this is legal or insurance advice, and a plan does not guarantee any outcome. It shortens the window in which you are improvising. If you want more operational walkthroughs in this format, they are collected on the Cursiqa blog.
The Short Checklist
- Eight to fifteen critical functions, written as verbs.
- Dependencies mapped one level past comfort, with single points of failure flagged.
- Maximum tolerable downtime and a tier for each function, Tier 1 capped at three.
- Contacts with mobile numbers and off-domain email addresses.
- A tested manual workaround for every Tier 1 and Tier 2 function.
- A printed copy plus an offline PDF on two devices.
- One 45-minute exercise per quarter with lessons logged, owned, and dated.
If you would rather start from ready-made sheets than a blank file, the Business Continuity & Critical Operations Binder is built for this exact job, and the rest of the practical workbooks live in the Cursiqa shop. Either way, do step one today — the function list is the part everything else hangs on.