A short business continuity policy statement template covering disruptive incidents, the continuity arrangements to have in place, and responsibilities.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on business continuity:

• Business Continuity Risk and Impact Analysis
• Backup, Business Continuity and ICT Recovery
• Emergency Preparedness
• ISO 22301 knowledge base

Logo Update Service

Download this policy template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription. This policy is also included in the ISO 27001 Toolkit and every alphaZ ISO toolkit that covers ISO 27001, so the toolkit route gives you this file plus everything else you need in one download. It is also included in the FORS Toolkit.

Need Help Implementing?

If you'd like this policy prepared for your organisation along with the rest of your company policies, or help with your information security risk assessment and treatment plan, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Business Continuity Policy Statement Template

A business continuity policy statement template committing to make the arrangements needed to maintain normal business operations and continuity of service, and setting out what those arrangements include.

The policy has Approved By and Date Approved fields and carries a Public information classification, so it can be shared with workers, clients and other interested parties.

What the Business Continuity Policy Statement Covers

• Policy statement - maintaining normal business operations and continuity of service
• Disruptive incidents - what counts as a disruptive incident
• Documented arrangements - part of the management system, reviewed and tested at planned intervals and after significant incidents
• Responsibilities, resources and training - an overview of continuity responsibilities and the resources and training needed
• Emergency recovery teams - details and responsibilities
• Procedures and plans - activation of continuity plans and emergency response, and business continuity and disaster recovery plans
• Risk register - review of potential disruptive incidents and business impact analysis
• Testing - ongoing testing of business continuity arrangements
• Business continuity management - a Business Continuity Lead responsible for the arrangements and objectives

Using the Policy

Add your company name and logo, check each commitment matches what your organisation does and edit any that do not, then approve and date the policy and share it with workers and anyone else who needs to see it.

Who Needs a Business Continuity Policy?

Organisations working to ISO 27001 or ISO 22301, and organisations whose customers ask how they would keep services running through a disruption.

Included in the ISO 22301 Toolkit

This policy is part of the ISO 22301 Toolkit and every alphaZ ISO toolkit that covers ISO 22301.

Works with the Business Continuity Procedure and Register

The PP-1-05 Business Continuity Policy Procedure sets out the continuity arrangements, the F-IMS21 Business Continuity Register records critical functions and continuity arrangements, and the TT-1-05 Business Continuity toolbox talk briefs workers.

Document Control

The footer carries the policy number and title, information classification, version and page numbers, and the approval fields record who approved the policy and when, so it can be controlled with the rest of your management system documents and listed on a document register such as the F-IMS20 Document Register.

Related Policies

• P-114 Cyber Security Policy - cyber security, including backups
• P-88 Information Security Incident Management Policy - information security incidents
• P-72 Risk Management Policy - risk management