A continuity plan is the written answer to what keeps the business running when something stops it. Continuity work is wider than IT recovery, which is why the checks start with the business and reach systems later. This business continuity plan checklist marks the plan you hold now, and it gives no template and no build steps. Treat the whole exercise as a review done on paper before an interruption, with evidence for every mark. Our guides on what stops a business and on writing the plan in the first place cover those two jobs, and our Maintain Business Continuity use case covers the wider help.
Last reviewed 2026-11-02 by Manish Sharma.
What a Business Continuity Plan Checklist Should Test
It should test whether each part of the plan can be shown, not whether the part exists. A plan with a heading called “suppliers” passes a glance, but only a supplier list with a named contact passes this review. In Signisys’ working description, the IT recovery side is one part of the plan, and our guide on how the two differ goes into that.
Two outside sources frame the review. The Ready.gov six-step training states its aim as organising a team and compiling a plan to manage a disruption, and it carries test-exercise materials alongside. NIST SP 800-34 Rev. 1, published in May 2010, is a contingency planning guide for federal information systems. It therefore informs only the IT rows here, such as check 7. ISO 22301 is a continuity management standard, and this article quotes none of it and makes no claim about its contents.
A Signisys observation: the checklists reviewed on 2 November 2026 were build lists, fill-in forms or short question lists. This one marks a plan you already have.
Marking Your Plan: Shown, Said or Absent
Every check receives a mark from a scale of three. Shown is worth 2 points: the plan satisfies the test in the table, and a dated record sits behind it. Said is worth 1 point: the plan makes the statement, but the record is missing, out of date, or covers only part of the business. Absent is worth 0: the plan is silent, or nobody can produce the item. Treat whatever the team does not show as Absent, no matter how sure they feel.
The scale runs to 32 points across 16 checks. When a check truly does not apply, cross it out, lower the top of the scale by 2, and write the reason beside it. Where a test calls for a sample, draw it from your own function list using a rule you write down, such as every third entry, so a second reviewer picks the same items.
Signisys names no pass mark here, because a cut-off figure would have no basis. Instead, start with the zeros, and the group each one falls in, before the total. That is Signisys’ view, not a standard.
Take check 2 as an illustration. Payroll run: the owner’s accepted downtime is written as the owner’s own figure and dated, so the mark is Shown. Customer support: a figure appears in the plan, but nobody can say who agreed it, so the mark is Said.
Key Takeaway Fix the zeros in the ranked order below before polishing the rest.
The business owner sets the tolerable downtime, and IT reports what the setup can meet. A plan that nobody can show remains unchecked.
Business Continuity Plan Checklist, Group 1: What Must Keep Running
A business continuity plan checklist has to begin with the business, so these four checks test the function list before any system appears. Collect that list before you mark anything.
| Check | Evidence to collect | Pass test |
|---|---|---|
| 1. The plan lists critical business functions, each with a named owner. | The function list, with an owner and a date on every row. | Yes if each row names one person who can answer for the function; a team name or a shared mailbox does not count. |
| 2. Each function carries the downtime its owner accepts. | The owner’s own figure in hours or days, marked as the owner’s. | Yes if every row holds a figure, because “as soon as possible” is not one. |
| 3. The plan ranks functions in restart order. | A numbered order, including a reason beside each entry. | Yes if no function restarts before the function it depends on. |
| 4. The plan states which functions it does not cover. | A short list of functions the plan does not cover, with the reason for each. | Yes if the business owner has agreed each exclusion on a stated date. |
Check 2 asks only for the owner’s figure per function. Our data recovery plan checklist covers the matching recovery targets for data, and meeting RTO and RPO targets covers the wider help.
Group 2: What Each Function Depends On
Every function leans on people, a place, systems and suppliers, and this part of the business continuity plan checklist asks whether the plan names each one.
| Check | Evidence to collect | Pass test |
|---|---|---|
| 5. Each critical function has a cover person. | A cover list showing who steps in when each owner is away. | Yes if the cover person has done the task, or has been shown it, on a date the plan owner can state. |
| 6. The plan writes down a fallback place of work or a remote-work route. | The address or the route, and who may use it when the main office is closed. | Yes if a named person can say how staff reach it. |
| 7. IT systems and data appear by name against the functions they serve. | A function-to-system table, including the data each function needs. | Yes if no function lists “IT” alone; the plan also points to its data recovery document. |
| 8. The plan lists key suppliers with a contact and a fallback. | The supplier list, the contact for each, and what the firm does if one fails. | Yes if each critical function’s main supplier has a named contact. Read your own supplier documents for their terms. |
Data coverage, retention and restore rows belong to the data recovery checklist.
Business Continuity Plan Checklist, Group 3: The Day an Interruption Starts
This part of the business continuity plan checklist tests the day itself, not the paper. Each check is a test you can run in one meeting.
| Check | Evidence to collect | Pass test |
|---|---|---|
| 9. A named person may declare an interruption, with a deputy. | The plan’s authority line, including the deputy’s name. | Yes if two names appear and both can say they hold that authority. |
| 10. The plan writes down the trigger that starts it. | The condition that starts the plan, such as a lost site, in the plan’s own words. | Yes if someone outside IT can say when the plan starts. |
| 11. Staff and customers hear through more than one route. | The contact roster and the list of routes, including any that avoid email. | Yes if at least one route works when the mail system is down (a Signisys check, not a statistic). |
| 12. A copy of the plan stays reachable without the main systems. | The place where the copy lives, and who can reach it without the main systems. | Yes if a named person retrieves it on their own phone or laptop during the review. |
If your plan names who the firm calls in during an attack, the ransomware case has its own checklist. Also, attack steps stay out of this article.
Group 4: Proof and Upkeep
This group asks whether anyone has exercised the plan and kept it current. Your business continuity plan checklist marks for checks 13 to 16 show how much of the earlier work has been proved.
| Check | Evidence to collect | Pass test |
|---|---|---|
| 13. A dated exercise exists. | The exercise record, including the date, the scenario and the attendees. | Yes if the plan owner can show one exercise in the last review cycle. |
| 14. Each exercise finding has a closed action. | The findings list, with an owner and a close date on each. | Yes if the owner has closed every finding or carried it forward with a date. |
| 15. Someone reviews the plan each time the business changes. | A review log set against a change log, such as a move, a new system, a new supplier or key staff leaving. | Yes if the last review comes after the last major change. |
| 16. A named plan owner exists, and new staff learn their role. | The owner’s name and an induction record that shows when each joiner learned their role. | Yes if one recent joiner can say what they do in an interruption. |
The test method sits outside this article. Testing recovery readiness covers how to run an exercise.
Key Takeaway In Signisys’ view, an exercise with every finding closed shows more than a larger one that leaves findings open.
A Ranked Work List from Your Marks
Fix the zeros in this sequence, which is Signisys’ own choice and not a standard. Start with checks 1 and 2: an unlisted function has no restart plan at all. Next come checks 9 to 12, which decide how the first day goes. Checks 13 and 14 are the proof step, and the remaining checks go in table order.
Before you ask for any budget, take every downtime figure with no record back to the function owner to confirm or change. The table below turns each mark into a task. Repeat the business continuity plan checklist after every major change, using the same checks and the same sampling rule.
| Mark | What to do | Owner | By when |
|---|---|---|---|
| If check 1 or 2 is Absent | Add the missing function or owner to the list. | A named person. | Your date. |
| If check 9 or 10 is Absent | Write the authority line and the trigger. | A named person. | Your date. |
| If check 11 or 12 is Absent | Add a second contact route and store a copy of the plan that opens without the main systems. | A named person. | Your date. |
| If check 13 or 14 is Absent | Schedule one dated exercise and log its findings. | A named person. | Your date. |
| If any check is Said | Find the missing record, or extend the check to the rest of the business. | A named person. | Your date. |
The work itself takes four moves:
- Gather the function list and each owner’s figure.
- Score all 16 checks.
- Group the zeros by check range.
- Assign each a single owner and a deadline.
Where Your Own Review Stops Being Enough
Your own review reads documents. Ask for outside help in four situations: no owner will commit to a downtime figure, the function list will not come together, an exercise would disturb live work, or the plan has to satisfy an obligation. For that last one, speak to your legal adviser, because this article cites no rule for India or the GCC.
Overall, top marks on this business continuity plan checklist mean the paper holds up. A real interruption is the only test of whether the business would keep running. This article leaves out causes of downtime, build steps, comparisons with disaster recovery, data restore checks, attack steps, insurance, legal duties and the wording of crisis communications. Signisys does this review for clients, and the CTA box that follows sets out what it includes.
Frequently Asked Questions
How many checks does a business continuity plan checklist need?
Can an IT team mark the business continuity plan checklist without the business owners?
If every check is marked Shown, is the business covered?
How soon after a move or a new system should the plan be checked again?
Is a continuity plan the same as an IT recovery plan?
Does this business continuity plan checklist come with a template?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.