Checklist: creating a first business continuity plan
For: SME management
Updated: 2026-11
A first business continuity plan is created in seven steps: identify critical processes, assess the impact of an outage, set recovery objectives, describe fallback procedures for each critical process, make contacts available offline, exercise the plan and update it regularly.
Many SMEs have an IT emergency plan but no plan for how the business continues while IT is down. That is exactly what a business continuity plan describes.
This checklist leads to a first, lean version. A full management system under ISO 22301 goes further.
The checklist
- 01
Identify critical processes
List the processes without which the company earns no revenue or breaches obligations.
Done when: A list of critical processes with owners exists.
- 02
Assess impact
For each process, estimate the consequences of an outage over hours, days and weeks.
Done when: For each critical process the maximum tolerable downtime is recorded.
- 03
Set recovery objectives
Determine RTO and RPO for the underlying systems and agree them with IT.
Done when: Objectives are set and IT has confirmed backups can meet them.
- 04
Describe fallback procedures
Record for each critical process how it continues without the usual systems.
Done when: Every critical process has a described fallback procedure.
- 05
Make contacts available offline
Keep a contact list with staff, providers, insurer and authorities available outside IT.
Done when: The list exists on paper and on an independent device.
- 06
Exercise the plan
Run at least one tabletop exercise and one restore test a year.
Done when: An exercise has been held and findings incorporated into the plan.
- 07
Update
Review the plan when processes, systems or staff change.
Done when: The plan carries a date and a next review date.
Common mistakes
- —Storing the plan only in IT, which is unavailable in an emergency.
- —Setting recovery objectives backups cannot meet.
- —Considering only IT systems and forgetting suppliers or staff.
- —Never exercising the plan.
What this checklist does not cover
- —The checklist leads to a first version, not a certifiable management system.
- —Sector-specific requirements, for example for financial institutions, may go further.
- —Technical recovery concepts must be produced separately.
Parent service: Cyber readiness & IT security
FAQ
How extensive must an SME plan be?
A few pages are often enough, as long as critical processes, fallback procedures, contacts and responsibilities are clear.
How does it differ from an incident response plan?
The incident response plan governs the reaction to the incident; the business continuity plan governs keeping the business running.
Is there a Swiss reference?
The ICT minimum standard of the Federal Office for National Economic Supply offers practical guidance.
More checklists
Checklist: optimising a Google Business Profile
A Google Business Profile is optimised in seven steps: verify the profile, choose the right primary category, record name, address, phone and opening hours correctly, describe services, upload real photos, gather and answer reviews fairly and keep details consistent with website and directories.
EU AI Act conformity: a checklist for the first pass
A workable first pass through the EU AI Act has six parts: know which AI runs in the business, determine your role for each system, classify under Article 6, check transparency duties separately, ensure AI literacy, and file everything so it can be found under scrutiny.
High risk or not: reasoning an Annex III classification properly
High-risk classification follows a fixed order: first the deployment area under Annex III, then whether the system plays a substantive role in the decision, then the exemption in Article 6(3). Each of those steps has to be documented with reasoning.