Five steps, about eight minutes. The plan is generated in your browser, on the ISO 22301 structure and with the continuity requirements of NIS2, DORA, ISO 27001 and the GDPR, and it leaves with you as a document to print or download as Word.
Enable JavaScript to use the generator. Or write to us and we will build the plan together.
The generated document has the structure of a complete continuity plan, at the scale of a small or medium-sized organisation: the readiness summary, with the priority gaps; the purpose and the reference frameworks; the crisis management team and the activation criteria; the business impact analysis, with the RTO and RPO targets for each critical process; the systems and suppliers you depend on; a response for each scenario chosen (cyberattack, outage, site unavailable, key people, suppliers); the rules for backups; the hour-by-hour response procedure; the mandatory notifications; testing and review; the annexes with the contact list and the implementation checklist.
The "Owner" columns and the contacts in the annexes remain for you to complete: this is information we neither ask for nor store.
The structure follows ISO 22301, the standard for business continuity management: impact analysis, strategies, response procedures, testing and improvement. On top of it, the plan takes the concrete requirements of the frameworks you choose:
The generated plan is a starting document, not an approved one. Complete the annexes, check the targets with the process owners, have it approved at management level and schedule the first restore test and the first tabletop exercise. The gaps marked in the summary are the order of work for the next 90 days.
If the organisation falls under NIS2 or DORA, the plan must be linked to the security policy and the incident reporting procedure. Our information security services cover the impact analysis, testing the plan and alignment with audit requirements.
For essential and important entities under NIS2 (GEO 155/2024), business continuity, backups, disaster recovery and crisis management are mandatory measures. Financial entities have the same obligation under DORA, and organisations certified to ISO 27001 have it under controls 5.29 and 5.30. For other organisations there is no express obligation, but Article 32 GDPR requires the ability to restore the availability of personal data in a timely manner, and a written plan is the simplest proof.
The business continuity plan concerns the whole organisation: which processes must keep running, who decides, how people work without the site or without the systems, whom we notify. The disaster recovery plan is the technical part: how systems and data are restored within the target time. The document generated here covers both at the level of a small or medium-sized organisation.
RTO (recovery time objective) is the maximum time within which a process or system must be back in operation. RPO (recovery point objective) is the maximum amount of data the organisation accepts to lose, expressed as the interval between the last backup and the incident. The questionnaire derives them from the maximum tolerable period of disruption and from your tolerance for data loss.
At least once a year, a tabletop exercise with the crisis team and a restore test from backups, plus after any major change of systems, suppliers, site or key people. NIS2 and DORA require tests to be documented, because the evidence is requested in audits and inspections.
We go through the impact analysis with your team, set realistic targets and run the first tabletop exercise.