Business Continuity Plan
The operational plan Your Organization activates to keep critical business processes running through a disruption — priorities driven by the Business Impact Analysis, activation criteria, roles, communications, and the path back to normal operations.
Maps to FedRAMP Moderate CP-2 · ISO/IEC 27001:2022 A.5.29 · NIST Cybersecurity Framework 2.0 RS.MA-05 · NIST Cybersecurity Framework 2.0 RC.CO-03
Read it now — the PDF opens either way.
Purpose
This plan tells Your Organization what to do in the first hours and days of a disruption that threatens the organization's ability to deliver critical business processes — not just its IT systems. It works alongside the Business Continuity and Disaster Recovery Policy (which sets the program's objectives and tiering) and the Disaster Recovery Plan (which covers technical system recovery in detail).
Scope
This plan applies to every critical business process identified by the Business Impact Analysis (BIA), and to the workforce members, facilities, and third parties those processes depend on. It covers non-technical continuity — people, process, facilities, and communications — leaving system-level recovery procedure to the Disaster Recovery Plan.
8 more sections in the full template
Business Impact Analysis and priorities · Activation criteria · Roles · Communications · Alternate operations · Return to normal operations · Testing and maintenance · Review cadence. Download the full document above, or open it in CMDash to fill in your organization name and effective date automatically.
Use this policy for real, not just on paper
“Open in CMDash” pre-selects the Business Continuity Plan template the first time you create a policy — your organization name and today’s date fill in automatically, and it lands as a DRAFT you can edit before publishing.