The following outline was extracted from a generally accepted practices (GAP) document prepared by the Disaster Recovery Journal Editorial Advisory Board and the Disaster Recovery Institute International (Yelland, 2007). This outline can be used as the basis for developing a business continuity plan (BCP). Customize the BCP for a particular organization, as appropriate.

1. Preplan Activities
1. Ensue the plan has executive oversight and authority before proceeding.
2. Ensure that a business continuity policy is defined for the organization.
3. Define, clarify and develop sponsor communication procedures.
4. Develop, present, and obtain approval for planning assumptions and exclusions.
5. Review organizational structure and management hierarchy for planning effort.
6. Verify contact information, availability, and supervisory approval for all involved.
7. Define project scope, schedule, and reporting points. Verify management approval and support for these components.
8. Develop plan content guidelines.


2. Data Gathering
1. Complete a risk assessment for all parts of the plan.
2. Use the completed Business Impact Analysis (BIA) (see Appendix A) to confirm impact to all critical business processes and systems for prolonged outages.
3. Validate and clarify statements from executive management about the mission, vision, and goals of all aspects of the plan.
4. Identify mission critical processes and any other processes that support the specific mission critical processes. Clarify the impact other processes may have on mission critical processes.
5. Validate information about all goals with management to ensure the scope and size of the plan development effort will meet the organization’s needs.
6. Establish requirements for resources and organizational commitment to complete plan development and implementation effort.
7. Ensure all impacts not captured in the BIA have been analyzed and recorded.
8. Identify and itemize vital records critical to the organization, including the critical tools and processes used to retain the records.
9. Identify and itemize vendors critical to the organization’s mission and core business processes and functions.
10. Identify key customers who will require notification or business modifications during time of disaster. Include required escalation procedures and parameters.


3. Data Analysis and Consolidation
1. Will the plan provide for recovery in time? Confirm overall recovery time objectives are achievable with recovery performance capabilities.
2. Will the plan meet objectives? Confirm overall recovery point objectives are achievable with recovery performance capabilities.
3. Finalize personnel and resource requirements to develop and implement the plan.
4. Review, clarify, and understand the recovery alternatives available for each critical business function as well as cost analysis.
5. Consider various approaches to develop the BCP documentation and effort.
6. Determine if the recovery plan strategy requires a business case analysis.
7. Review and confirm recovery site selections and build-out requirements.
8. Define key parameters that the plan must address. Minimum considerations are:
1. Legal and regulatory requirements,
2. Contracts and agreements,
3. Distinction between recovering business processes and technology,
4. Workplace,
5. Staffing,
6. Recovery procedures,
7. Disaster analysis, definition, notification, and escalation procedures,
8. Backups and alternative worksites.


4. Plan Documentation
1. Document overview and scope, including considerations for any classified information.
2. Include assumptions and impacts if assumptions are not valid.
3. Include exclusions and potential impact of not including specific items.
4. Include compliance statements about required items.
5. Identify teams for each process, including team responsibilities.
6. Document disaster identification, declaration, and escalation processes.
7. Document supporting resources.
8. Define and clarify all controls, including authority and compliance issues.
9. Display recovery flow graphically, whenever possible. Include up and down stream requirements and dependencies.
10. Provide an overview of each sub-component of the overall plan. Minimum requirements are:
1. Command and control
2. Communication plan (both internal and external)
3. Media interface plan (pre-scripted and approved messages)
4. Technology and tools plan
5. Workplace plan
6. Staffing plan
7. Operational procedures plan for each phase of the recovery
8. Supply chain plan dependencies and work-around procedures.
11. Include whatever appendices are required to provide details about specific items. Examples include:
1. Validation schedule
2. Key internal contacts (detailed information)
3. Key vendors and suppliers (detailed information)
4. Off-site resource information
5. Graphics (maps, floor plans, photos, organization charts, flow charts, etc.)
6. Inventories
7. Sub-plan details, as applicable
8. Reporting requirements
9. Event tracking requirements
10. Compliance requirements and references


5. Follow-Up Activities
1. Plan for status reporting. Provide schedule for and document audits and changes.
2. Plan recommendations report to include, but not limited to:
1. Confidentiality
2. Plan maintenance and distribution
3. Validation process
4. Audit process
5. Training requirements
6. Awareness program
7. Command and control
3. Post-Incident documentation. Include debrief procedures, gather status reports, identify and record key learning points, gather cost accounting details, and gather appropriate visual records of events (e.g., photos, newspaper reports, internal and external communications).

Yelland, L. (Ed.). (2007). Generally accepted business continuity practices: A look at business continuity best practices. A joint project of Disaster Recovery Journal and Disaster Recovery Institute International. Retrieved February 18, 2008 from http://www.drj.com/GAP/