Most teams don't think about continuity until something breaks.
A key person leaves. A system goes down. A supplier drops out. And suddenly you realise there’s no plan. Who’s supposed to handle this? How fast do we need to fix it? Who do we tell?
That's not a disaster. That's a planning gap.
The good news is that you don't need a 40-page document to close it. You just need a few clear decisions made in advance, and a place to document them.
What is a business continuity strategy?
A business continuity strategy is your organisation's plan for staying operational when something disrupts normal work. That disruption could be a cyberattack, a natural disaster, a key supplier dropping out, or something as mundane as a critical system going offline for 48 hours.
The goal isn't to prevent every possible problem. It is to reduce the impact of disruptions by deciding in advance what gets prioritised, who does what, and how quickly you expect to recover.
It's broader than disaster recovery, which focuses mainly on restoring IT systems. Business continuity covers people, processes, communication, and can sometimes include the business objectives your organisation is actually trying to hit.
Why most continuity plans don't work
Many organisations have a business continuity plan sitting somewhere. But the issue is that instead of being a living document, it turned into a compliance artifact that has been forgotten.
Someone wrote them once, they got approved, and they've lived untouched in a shared drive ever since. No one's tested them. Half the named owners have changed roles. The contact list is two years out of date. Plans fail when they're not connected to how the team actually works.
When something actually goes wrong, teams default to whoever shouts loudest instead of referring back to the business continuity plan.
The organizations that handle disruptions well have a different approach: they treat continuity as an ongoing practice, not a one-time document. See our post Don't let good strategies fail for more on how execution habits matter more than planning sessions.
The 5 steps of a good business continuity plan
Building a BCP doesn't have to be complicated. Most solid plans follow the same five steps:
1. Risk assessment
Identify what could disrupt your operations. Cyberattacks, natural disasters, supply chain failures, key person dependencies, power outages… And assess both the likelihood and the potential impact of each.
The goal isn't an exhaustive list of everything that could go wrong. It's surfacing the handful of scenarios that would actually threaten the business.
2. Business impact analysis (BIA)
For each risk, map what would actually break. Which functions would stop? What's the financial impact per day of downtime? What are the reputational risks?
The BIA is what turns a vague risk list into a prioritized set of critical functions. It tells you what to protect first.
3. Strategy development
Based on the BIA, decide how you'll respond to each major risk. This is where you set recovery time objectives (RTO = how fast you need to restore a function) and recovery point objectives (RPO = how much data loss is acceptable).
You'll also identify backup systems, alternative suppliers, and workarounds for each critical function.
4. Plan development
Document the plan: who does what, in what order, through which channels. Include contact lists, escalation paths, and communication templates.
Keep it short. A two-page plan your team has actually read beats a 50-page binder nobody has. A status report template for crisis comms is a useful addition here.
5. Training and testing
A plan that's never been tested is just a hypothesis. Run a tabletop exercise at least once a year — walk key owners through a disruption scenario and see what breaks.
Treat it like a retrospective — low stakes, high learning. Update the plan based on what you find.
The 4 Ps of business continuity
A useful framework for making sure your plan covers all the bases. Every continuity strategy should address these four areas:
- People: who is responsible for what during a disruption, who are the backups, and how do you protect employee safety and wellbeing
- Processes: which critical operations need to keep running, and what are the workarounds if normal processes break down
- Premises: what happens to your physical locations or infrastructure, including plans for remote work or site relocation
- Providers: which suppliers, vendors, and partners are you dependent on, and what's your plan if they go down
Supply chain dependencies in particular tend to be underestimated. Most teams think about internal disruptions but don't map their exposure to a key SaaS tool going down, a logistics partner failing, or a cloud provider having an outage.
Who is responsible for the business continuity plan?
In most organisations, it's a shared responsibility with clear leads.
- Senior leadership (CEO/COO) owns the overall strategy and signs off on it. They also take charge during a major disruption.
- Department heads own their slice: IT handles technical recovery, Finance handles financial impact, HR handles people continuity.
- A business continuity manager or Chief of Staff (in larger orgs) coordinates the whole thing, keeps it updated, runs the tests, and makes sure it doesn't gather dust.
The biggest failure mode is treating ownership as collective "the whole leadership team owns it" as it means in practice that nobody really does.
Assign a named person. Give them a calendar reminder to review it twice a year.
Example of a simple business continuity strategy
Here's what a lightweight continuity strategy looks like in practice for a 50-person SaaS company.
The connection to your goals that most teams miss
Continuity planning and goal-setting are the same problem from different angles.
Teams that have clear OKRs recover from disruptions faster. Not because OKRs are magic, but because everyone already knows what matters. There's no debate about what to fix first as the priorities are visible.
When building your continuity strategy, ask: which key results would each critical function affect if it went down? That's your triage order.
How AI can help you build your continuity strategy faster
You don't need to start from a blank page. AI tools like ChatGPT, Claude, or Gemini can do a lot of the heavy lifting by drafting your BIA, stress-testing your plan, and generating communication templates.
Here are a few prompts worth trying:
Prompt 1: Run a business impact analysis
I run a [type of company, e.g. 50-person B2B SaaS company].
Help me run a business impact analysis.
List my most likely disruption scenarios (cyberattack, key person departure, supply chain failure, infrastructure outage, natural disaster), and for each one:
- Estimate the financial impact per day of downtime
- Identify which business functions would be most affected
- Rate the likelihood as low/medium/high.Prompt 2: Identify your critical functions
Here are our top company goals for this year: [paste your OKRs or goals].
Based on these, which business functions are most critical to protect in a continuity plan?
For each critical function, suggest a recovery time objective (RTO) and a recovery point objective (RPO).Prompt 3: Draft a crisis communication message
We're experiencing [type of disruption, e.g. a major cloud outage affecting our product]. Draft three versions of a customer-facing communication:
- One for the first 30 minutes (acknowledging the issue)
- One for the 4-hour update (progress and ETA)
- One for the all-clear (resolution and what we're doing to prevent recurrence).
Keep them honest, calm, and brief.Prompt 4: Stress-test your plan
Here is our current business continuity plan: [paste your plan].
Play devil's advocate.
- What are the three most likely ways this plan would fail in a real crisis?
- What assumptions are we making that might not hold?
- What's missing?AI won't replace the judgment calls. You still need to decide what matters most and who owns what. But it can compress hours of drafting into minutes, and it's genuinely good at stress-testing assumptions you might not have thought to question.
Where to start (without overcomplicating it)
You don't need a consultant or a 6-month project. Start with a single 60-minute working session:
- Run a quick risk assessment: list the five scenarios that would hurt most
- Do a lightweight BIA: map which functions each scenario would break
- Name a primary owner and backup for each critical function
- Set an RTO and RPO for each critical function
- Write one sentence on what to do if each function fails
- Book a review in six months
That's it. That's your v1.
Momentum beats perfection here. A simple plan your team knows about is worth ten times more than a comprehensive one nobody's read.
Keep your priorities visible when things get hard
Tability helps teams stay aligned on their goals with a lightweight weekly rhythm. When disruption hits, you'll know exactly what to protect because your priorities are already clear.
.png)
.jpg)
