If your business lost access to its systems at 8am tomorrow, would your team know who makes the calls, which customers to contact first and how to keep invoicing going?
Plenty of businesses have a business continuity plan. Far fewer have one anyone has opened since it was written. It sits in a shared drive, names a manager who left two years ago and assumes a server you’ve since moved to the cloud. Closing that gap is mostly a matter of planning and practice.
This guide gives you a business continuity plan checklist to test what you’ve got, then covers how to rank your critical functions, how often to review and run tests, and which Australian obligations apply.
Why Business Continuity Planning Matters Right Now
The numbers from the past year make the case on their own. In 2024–25, the Australian Signals Directorate received over 84,700 cybercrime reports, about one every six minutes, and responded to more than 1,200 cyber security incidents, up 11% on the year before. That’s from the ASD’s Annual Cyber Threat Report factsheet for businesses, which also lists the average self-reported cost of cybercrime per report:
| Business size | Average cost per report | Change on 2023–24 |
|---|---|---|
| Small | $56,600 | Up 14% |
| Medium | $97,200 | Up 55% |
| Large | $202,700 | Up 219% |
Data breaches are climbing too. The Office of the Australian Information Commissioner received 1,205 data breach notifications in 2025, the most in a calendar year since the Notifiable Data Breaches scheme started. Malicious or criminal attacks caused 716 of them.
Cyber is only one way a business goes offline. Floods, bushfires, storms, a long power outage or a key supplier going under can all do it with little warning. Good business continuity planning means that when one of those hits, your team is following steps it has already practised instead of making it up on the day.
What Is a Business Continuity Plan?
A business continuity plan (BCP) sets out how your organisation keeps its most important work going when something breaks, and how it gets back to normal afterwards. So what is a business continuity plan in practical terms? It belongs to the business as a whole, and the IT team shouldn’t be its only owner.
The Australian Government’s emergency management plan guide treats continuity as one part of a wider emergency plan, alongside an emergency action plan and a recovery plan. It’s a good companion read if your business is exposed to severe weather.
The Components of a Business Continuity Plan
Strip away the templates and the components of a business continuity plan come down to answers to five questions:
- What matters most? The critical functions, systems and suppliers the business can’t run without. Working this out is called a business impact analysis.
- Who’s in charge? The people authorised to make decisions and lead the response, plus who steps in when they’re unavailable.
- How fast do we need it back? The longest each function can be down, and how much data it can afford to lose, before the damage gets serious.
- Who do we tell, and how? The communication plan for staff, customers, suppliers, insurers and regulators.
- How do we know it still works? The review and testing schedule that keeps the plan current as the business changes.
If you’d rather start from a template than a blank page, the Queensland Government’s business continuity planning resources include a free BCP template.
Business Continuity vs Disaster Recovery
People mix these two up all the time, but they do different jobs. On business continuity vs disaster recovery, the short version is this: a disaster recovery plan (DRP) gets your IT systems and data back, while a business continuity plan keeps the whole organisation working, with technology as one piece of it.
| Business continuity plan | Disaster recovery plan | |
|---|---|---|
| Focus | Keeping the whole business operating | Restoring IT systems, data and infrastructure |
| Owner | Leadership team | IT team or managed IT provider |
| Scope | People, processes, premises, suppliers, communication and technology | Servers, cloud services, backups, networks and applications |
| Key measures | Maximum tolerable downtime for each critical function | Recovery time objective (RTO) and recovery point objective (RPO) for each system |
Two of those terms are worth unpacking. The RTO is how quickly a system has to be running again. The RPO is how much data, measured in time, you can afford to lose: an RPO of four hours means the last good backup can be no more than four hours old.
Getting the servers back doesn’t help much if nobody knows who signs off on decisions, which clients to ring first or how payroll runs while the office is shut. Treat your disaster recovery plan as a section inside the business continuity plan, not a substitute for it.
Business Continuity Plan Checklist
No two plans look the same, but strong business continuity plans all cover the same ground. See how yours measures up:
- Scope and triggers. The plan says what it covers and exactly when it kicks in: a cyber incident, a system outage, losing access to the premises.
- Critical functions mapped. You know which functions keep the doors open, which systems each relies on and how long each can be down.
- Named people, with backups. Every key role, from incident lead to communications, has a named person and a named stand-in.
- A communication plan. You know who needs to hear from you, in what order and how quickly, with contact lists that are current and stored somewhere you can reach when your systems are down.
- Backups you’ve actually restored. Critical data is backed up separately from your main systems, restores are tested, and recovery targets are agreed with your IT provider.
- A review and testing schedule. The plan has a review date, a record of who approved the current version and a testing calendar.
If you ticked all six, you’re ahead of most. If you didn’t, the gaps tell you where to start.
Not Every Function Needs the Same Recovery Speed
One of the most common mistakes in business continuity planning is treating everything as equally urgent. You end up with either an expensive plan that tries to protect everything or a vague one that protects nothing in particular.
Match the recovery speed to the damage a function’s outage would do. These tiers are a starting point to adjust for your business:
Tier 1, critical: back within hours. Anything that stops revenue, breaches an obligation or puts people at risk when it fails. Think customer-facing systems, phones, email and payment processing.
Tier 2, important: back within one to three days. Functions that hurt to lose but can limp along on a manual workaround for a while, such as payroll, invoicing, CRM and project management tools.
Tier 3, deferrable: back within a week or more. Work you can pause without real harm, like internal reporting, archiving and non-urgent projects.
Tiering keeps your spending on backups, redundancy and recovery in proportion to what each outage would cost you. For many businesses, a well-planned hybrid cloud strategy is one of the most cost-effective ways to shorten recovery times for Tier 1 systems.
Business Continuity Testing: How Often to Review and Test
Review the plan at least once a year, and again whenever the business changes in a way that would affect how it responds. Common triggers for an out-of-cycle review:
- A key person joins, leaves or changes roles
- You move offices or open a new site
- You bring in or replace a critical system, cloud platform or supplier
- A merger, acquisition or big change in headcount
- A real incident or near miss, even a minor one
- New regulatory, contractual or insurance requirements
Reviewing the document is half the job. Business continuity testing shows if the plan holds up in a real disruption, and it regularly turns up problems you’d never spot on paper, like a phone tree full of old numbers or a recovery step only one departed staffer knew how to do.
There are three practical levels of business continuity test most businesses can run:
- Tabletop exercise. The leadership team talks through a realistic scenario, say ransomware on a Monday morning, decision by decision, using the plan.
- Technical recovery test. Your IT team or managed IT provider restores critical systems and data from backup to check recovery times hit your targets.
- Full simulation. Staff work through a simulated disruption, such as a day without office access, to test the plan end to end.
The technical test is the one most often skipped. The ASD’s Essential Eight maturity model asks, even at Maturity Level One, that backups be kept in line with business continuity requirements and that restoration be tested as part of disaster recovery exercises. For most small and medium businesses, one tabletop exercise and one technical recovery test a year is a sensible minimum.
Business Continuity Plan Australia: What the Law Requires
No single law requires every Australian business to have a business continuity plan. Several legal, regulatory and contractual obligations still make one the practical baseline for a lot of organisations.
Privacy Act 1988 and the Notifiable Data Breaches scheme
The Privacy Act generally covers businesses with annual turnover above $3 million, plus some smaller ones, including private sector health service providers and businesses that trade in personal information. Covered businesses must take reasonable steps to protect personal information under Australian Privacy Principle 11. Under the Notifiable Data Breaches scheme they must notify the OAIC and affected individuals when a breach is likely to cause serious harm. A plan with a clear incident response and communication process makes that far easier to do under pressure.
WHS emergency plans
Under the model WHS Regulations, workplaces need an emergency plan covering how to respond, evacuation, notifying emergency services and when the procedures get tested. It isn’t a continuity plan, but the two should point to the same people and the same contact lists.
APRA CPS 230 Operational Risk Management
For banks, insurers, super trustees and other APRA-regulated entities, CPS 230 commenced on 1 July 2025. It requires them to identify critical operations, set tolerance levels for disruption, keep a credible business continuity plan and manage the risk from material service providers. If you supply services to an APRA-regulated entity, expect questions about your own continuity arrangements.
Security of Critical Infrastructure Act 2018
Responsible entities for specified critical infrastructure assets, across sectors including energy, water, transport, health care, food and grocery, and data storage or processing, must keep a critical infrastructure risk management program. It has to address cyber, personnel, supply chain and physical and natural hazards, which overlaps heavily with what a continuity plan covers.
Insurers, clients and contracts
Cyber insurance applications commonly ask about backups, incident response and continuity arrangements. Many client contracts and government tenders include service level commitments and continuity requirements too. A documented, tested plan lets you answer those questions straight away instead of scrambling at renewal time.
If you want a formal benchmark, AS ISO 22301 is the Australian adoption of the international standard for business continuity management systems. Most small businesses won’t need certification, but it’s a useful reference for larger organisations and those supplying to them.
Your Next Step with Corp IT
Corp IT works with Australian businesses to make sure their technology can deliver the continuity plan their leadership team has signed off. We can help you:
- Map the systems and data your critical functions depend on
- Check your backup, recovery and remote access set-up against realistic recovery targets
- Strengthen your cyber security to cut the likelihood and impact of an incident
- Run technical recovery tests and support your tabletop exercises
Not sure where your current plan stands? Our practical guide to reviewing your cyber security environment is a good place to start. If you’d like a hand, talk to our managed IT services team or call us on (07) 3077 6844.
Frequently Asked Questions
What should a business continuity plan include?
At minimum:
- A business impact analysis of your critical functions
- Named roles and responsibilities, with backups
- Recovery targets for each critical function
- A communication plan for staff, customers, suppliers and regulators
- Technology and data recovery arrangements
- A review and testing schedule, with a record of who approved the current version
How often should a business continuity plan be reviewed?
At least once a year, with a tabletop exercise or recovery test at least annually. Regular testing is part of a shift towards proactive IT management, where problems get found and fixed before they cause downtime. Update the plan after any significant change too, such as new systems, key staff changes, an office move or a real incident.
Is a business continuity plan a legal requirement in Australia?
Not for every business. APRA-regulated entities must meet CPS 230, critical infrastructure entities have risk management obligations under the SOCI Act, and businesses covered by the Privacy Act must protect personal information and report eligible data breaches. All of those are far easier to manage with a documented plan.
Where can I find a free BCP business continuity plan template?
Two good government starting points: the Queensland Government’s BCP template on its continuity planning page, and the Australian Government’s emergency management template, which includes a continuity section. Either one only becomes useful once you’ve filled it in with your own functions, people and recovery targets.
What’s the difference between a business continuity plan and a disaster recovery plan?
A disaster recovery plan restores IT systems, data and infrastructure after an outage or incident. A business continuity plan is broader. It covers how the whole organisation keeps running, including people, premises, suppliers and communication, with disaster recovery as one part.
Who should own the business continuity plan?
The leadership team, because deciding priorities, spending and communication during a crisis are business decisions. Your IT team or managed IT provider plays the supporting role, making sure systems, backups and security controls can actually deliver the recovery targets in the plan.
