Business impact analysis
Which activities matter most, what stopping them costs and how long you can tolerate each being down.
Business Continuity Plan (BCP) Writing and Update
A business continuity plan (BCP) is the written plan that tells your organisation how to keep critical work running, and how to recover, when something stops it. We build it from a business impact analysis, so it reflects what actually matters to your business.
Business Continuity Plan (BCP)
What it is
A documentation project to analyse which of your activities cannot stop, set how fast each must come back, and write or update the plan, roles and contact trees to make that happen. It does not include drills or exercises.
Why organisations need it
Most organisations have a continuity document written for an auditor, and few have updated it since. When a fire, flood, supplier failure, outage or cyber attack hits, people need to know who decides, what comes back first and how customers are told. A plan built from a proper impact analysis answers those questions before the pressure starts, and gives directors evidence that continuity has been thought through rather than assumed.
What the engagement covers
Recovery priorities
Agreed recovery time and data loss targets for each critical activity, set with the people who own them.
The written plan
Scenarios, roles, decision rights, alternative arrangements and step-by-step recovery actions.
Crisis and communication
Who leads, who speaks to staff, customers, regulators and media, and with what message.
Dependencies
People, premises, technology, suppliers and data each critical activity relies on.
Update and maintenance
An existing plan reviewed against how you operate today, with a schedule for keeping it current.
What the business gets out of it
Priorities everyone agrees on
Management decides recovery order in calm conditions, not during an outage.
A plan people can follow
Short, role-based actions instead of a long policy document.
Evidence for boards and customers
A documented analysis and a current plan.
Aligned to ISO 22301
Structured on the business continuity standard, so certification stays an option later.
Less downtime and confusion
Clear owners and contact trees from the first hour.
How it works
How the engagement runs
01
Scope and sponsor
Agree what the plan covers and who owns it.
02
Impact analysis
Interviews and a short workbook for each department.
03
Strategy and plan
Choose recovery arrangements and write the plan.
04
Review
Management reviews and approves the plan and targets.
05
Hand-over
Walk your team through the plan and agree who maintains it.
Deliverables
What you receive
Business impact analysis report
Critical activities, impacts and recovery targets.
Business continuity plan
Scenarios, roles, actions and contact trees.
Crisis communication guide
Messages and responsibilities for staff, customers and regulators.
Update log
What changed from your previous plan and why.
Maintenance calendar
When the plan is reviewed and updated.
Who it is for
Who this is built for
Industries
Company sizes
Departments
What is included and what is not
| Item | Status | Detail |
|---|---|---|
| Business impact analysis | Included | Critical activities, impacts and recovery targets. |
| Written or updated BCP | Included | Scenarios, roles, actions and contact trees. |
| Crisis communication guide | Included | Messages and responsibilities for staff, customers and regulators. |
| Plan maintenance schedule | Included | When the plan is reviewed and updated. |
| Drills and exercises | Not included | Documentation only. A tabletop exercise can be arranged separately. |
| Technical recovery and failover testing | Not included | Stays with your IT team and vendors. |
| ISO 22301 certification | Not included | Issued only by an accredited certification body. |
FAQ
FAQ
A business continuity plan covers the whole organisation: people, premises, suppliers, communication and decisions. A disaster recovery plan is the technical part, restoring systems and data. We write the BCP and set the recovery targets that IT's disaster recovery plan must meet.
Usually six to ten weeks for a small or mid-sized organisation, depending on how many departments are in scope and how quickly interviews can be scheduled.
No. Certification must come from an accredited certification body. We structure the plan on ISO 22301 so that certification remains possible later, and we do not claim certification on your behalf.
No. This service is documentation only. A facilitated tabletop exercise can be arranged separately, and technical restore and failover testing stays with your IT teams and vendors.
Yes. We review the existing plan against how you operate today and update it, which is often quicker than starting again.