Business Continuity Policy Template: Scope, Roles, BIA and Testing Commitments

Many organisations have continuity plans but no policy that says who owns business continuity, which services must be covered, how often the analysis is refreshed and what level of testing leadership has committed to, so plans drift out of date and nobody is accountable when they fail. This template is the governance document that sits above the plans: a short, board-approved policy that sets the scope of the business continuity programme, its objectives, the roles that own it, and the minimum commitments for business impact analysis, strategies, plans, exercising, supplier continuity and review. It follows the policy elements in NIST SP 800-34 Rev. 1 and the policy and management review structure of ISO 22301:2019, with notes for EU financial entities under DORA Article 11. The operational content (impact scales, activity registers, invocation criteria, workarounds) belongs in the Business Continuity Plan Template. It is written for continuity managers, risk and compliance leads and the executives who approve the policy.

How to use this template

• Replace text in square brackets, such as [Organisation], [Chief Operating Officer] and [annually], with your own terms and values. Bracketed values are suggested defaults, not external requirements, except where a regulation is named.
• "Must" indicates a mandatory requirement. "Should" indicates a recommended practice where a documented exception may be justified.
• Keep this policy to commitments and accountability. Anything that changes often, such as contact lists, recovery time objectives for named activities or exercise calendars, belongs in the plan, the BIA or a supporting standard, so the policy only needs re-approval when governance changes.
• Run the business impact analysis after adopting the policy, using the Business Impact Analysis Template, then write plans with the plan template.
• Place this policy alongside your top-level Information Security Policy Template and reference it from your risk management policy.

1. Purpose

This policy establishes [Organisation]'s business continuity management programme. It sets out leadership's commitment to continue delivering prioritised products and services at acceptable predefined levels during a disruption, assigns accountability for the programme, and defines the minimum requirements that business continuity plans, analyses and exercises must meet. It supports [Organisation]'s obligations under [ISO 22301 certification / DORA / sector regulation / customer contracts] and its risk appetite for disruption as approved by [the board].

2. Scope

1. This policy applies to [all business units, subsidiaries and sites of Organisation] and to all employees, contractors and third parties who deliver or support products and services within scope.
2. The products and services in scope of the business continuity programme are: [list]. Exclusions: [list, with reason and the approver of each exclusion].
3. The programme must address disruption from loss or unavailability of people, premises, technology and data (including cyber attack), suppliers and outsourced services, utilities and transport.
4. IT system recovery is governed by [the disaster recovery policy and plan]; cyber incident handling by [the incident response policy and plan]; backup requirements by [the backup policy]. This policy sets the business requirements those documents must meet.

3. Policy statement and objectives

1. [Organisation] is committed to:
   • identifying the activities that deliver its prioritised products and services and the impact of their disruption over time;
   • maintaining strategies, plans and resources that allow those activities to resume within agreed timeframes;
   • meeting applicable legal, regulatory and contractual requirements for continuity;
   • exercising and testing its arrangements and learning from exercises and real incidents; and
   • continually improving the business continuity programme.
2. Business continuity objectives for the current period are set by [the executive sponsor] and recorded in [the BCM objectives register]. Each objective must be measurable, owned, resourced and dated. Example objectives: [every prioritised activity has an approved plan by (date)]; [all plans exercised at least once in the year]; [critical suppliers' continuity arrangements assessed by (date)].
3. This policy must be communicated to all staff within scope, made available to relevant interested parties on request, and kept as documented information.

4. Roles and responsibilities

The board's role follows NCSC board guidance: directors should seek assurance that incident planning, response and recovery are effectively managed, know their decision-making authority during a crisis including out of hours, and expect reports on exercise outcomes and lessons learned.

5. Programme requirements

5.1 Business impact analysis and risk assessment

1. A business impact analysis must be completed for all in-scope products and services at least [annually] and after significant change to products, structure, sites, technology or key suppliers.
2. The BIA must use criteria approved by [the executive sponsor], covering at least financial, customer, legal and regulatory, health and safety and reputational impact over time, and must set for each prioritised activity a maximum tolerable period of disruption, a recovery time objective, a minimum acceptable service level and the data loss it can tolerate.
3. The BIA must identify each prioritised activity's dependencies on people, premises, technology and data, suppliers and other activities, including identity and access services needed to work at alternate locations.
4. A risk assessment of disruption to prioritised activities must be completed at the same frequency and recorded in [the risk register].

5.2 Strategies and resources

1. For each prioritised activity a continuity strategy must be selected that can deliver the minimum service level within the recovery time objective, approved by [the executive sponsor] and funded, or the residual risk formally accepted by [the risk owner].
2. Strategies must not depend on a single person, site, supplier or system without a documented and accepted rationale.

5.3 Plans

1. Every prioritised activity must be covered by an approved business continuity plan containing at minimum: invocation criteria and authority, roles and deputies, communication arrangements, workarounds for loss of each dependency, resource requirements at alternate locations and return to normal procedures.
2. Plans must be accessible when primary systems are unavailable, including [offline or printed copies and an out-of-band contact method].
3. Plans must be reviewed at least [annually] and after each invocation, exercise finding or significant change.

5.4 Exercising and testing commitments

1. Every plan must be exercised at least [annually]. The exercise programme must include, each year, at least [one tabletop exercise for the Crisis Management Team], [one test of communications and call trees] and [one cyber attack scenario such as ransomware or loss of identity services].
2. Technology recovery tests must demonstrate recovery within the objectives set by the BIA, with measured times recorded.
3. Every exercise must produce a report with findings, owners and due dates; findings must be tracked to closure. Use the Tabletop Exercise After Action Report Template.
4. Exercise results must be reported to [the executive sponsor] and summarised for [the board] at least [annually].

5.5 Suppliers and outsourced services

1. Suppliers supporting prioritised activities must be identified in the BIA and assessed for continuity capability before contract and at least [annually] thereafter.
2. Contracts for such suppliers must include continuity obligations, notification of disruption within [X hours], the right to receive or take part in exercise results, and exit or substitution arrangements.

5.6 Training and awareness

1. Staff with roles in continuity plans must receive role-based training on appointment and refresher training at least [annually]. Crisis Management Team members must take part in at least [one] exercise per year.
2. All staff must receive awareness of how to report a disruption and where to find guidance.

5.7 Records

1. [Organisation] must keep records of BIA results, approvals, plans, exercise reports, invocations and decisions taken during disruptions for at least [X years].
2. During an invocation, decisions, times and rationale must be logged from the moment of activation.

6. Exceptions

1. Products, services or sites that cannot meet this policy must be recorded in [the exception register] with the reason, the residual risk, compensating measures and a review date.
2. Exceptions are approved by [the executive sponsor] and expire after no more than [12 months].

7. Compliance, monitoring and review

1. The [business continuity manager] must report [quarterly] to [the executive sponsor] on:
   • percentage of in-scope products and services with a current BIA;
   • percentage of prioritised activities with an approved, in-date plan;
   • exercises completed against the programme, and measured recovery times against objectives;
   • open exercise and audit findings, and those overdue;
   • critical suppliers with a current continuity assessment; and
   • staff with continuity roles who have completed training.
2. [The executive sponsor] must hold a management review of the programme at least [annually], covering performance against objectives, exercise and incident lessons, changes in risk, regulatory or business context, audit results and opportunities for improvement, and recording decisions and actions.
3. The programme is subject to independent review by [internal audit] at least every [two years], or [annually] where regulation requires.

8. Review and approval

Implementation guidance

Rollout

1. Agree scope and appetite first: get the board to confirm which products and services are in scope and the tolerance for disruption before running the BIA. Scope argued later delays every other step.
2. Appoint owners by name: the policy fails if business unit heads see continuity as an IT or risk team task. Name them in the roles table annex and brief them before the first BIA.
3. Run the first BIA cycle: use the BIA template, then compare the recovery objectives it produces with current IT capability. The gap list becomes the first set of objectives under section 3.2.
4. Write plans, then exercise one early: run a tabletop on one high-priority activity within the first [six months] to test the policy's assumptions. See the Tabletop Exercise Guide.
5. Hold the first management review: after the first full cycle, review what worked and adjust the bracketed frequencies to what the organisation can sustain.

Policy, plan or both

A small organisation can combine both into one document, keeping the policy sections at the front for approval and the operational annexes behind them.

Regulatory notes

• EU financial entities (DORA): Article 11 of Regulation (EU) 2022/2554 requires a comprehensive ICT business continuity policy as part of the ICT risk management framework, which may be a dedicated policy forming part of the overall business continuity policy; a business impact analysis of exposure to severe business disruptions; testing of ICT business continuity and response and recovery plans at least yearly and after substantive changes, including cyber attack and failover scenarios for entities other than microenterprises; a crisis management function; and accessible records of activities before and during disruptions. Set the bracketed frequencies in sections 5.1 and 5.4 no lower than these. See the DORA Guide.
• ISO 22301: organisations seeking certification need a top management policy that provides a framework for continuity objectives and commits to meeting applicable requirements and to continual improvement, communicated and available as documented information, plus a management review. Sections 3 and 7 are written to support this. See the ISO 22301 Business Continuity Guide.
• US federal systems: NIST SP 800-34 Rev. 1 makes developing the contingency planning policy the first of its seven planning steps and lists the elements it should define: roles and responsibilities, scope, resource requirements, training requirements, exercise and testing schedules, plan maintenance schedule, and minimum frequency of backups and storage of backup media. Backup frequency is delegated here to the Backup and Recovery Policy Template.

Failure patterns this policy is written to prevent

• Plans with no owner: section 4 makes business unit heads accountable for their own continuity, not the continuity manager.
• A BIA done once: section 5.1 ties the BIA to a cycle and to change events.
• Recovery objectives IT cannot meet: section 5.2 forces a funded strategy or a recorded risk acceptance.
• Exercises with no follow-through: section 5.4 requires findings with owners and dates, reported upward.
• Single-supplier dependence: section 5.5 requires continuity terms in contracts. When the clearinghouse in the Change Healthcare breach disconnected its systems, providers that relied on it alone could not process claims for weeks.

Framework mapping

Sources for the default values

• NIST: SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems
• EUR-Lex: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector
• NCSC: Board Toolkit, planning your response to cyber incidents

Related NHI Mgmt Group resources: Business Continuity Plan Template · Business Impact Analysis Template · ISO 22301 Business Continuity Guide · Backup and Recovery Policy Template · Crisis Management Guide