Table of Contents

• What a Business Continuity Plan Is and Why Norfolk Firms Need One
• Step 1: Identify the Risks and Disruptions Your Business Faces
• Step 2: Run a Business Impact Analysis and Set Recovery Priorities
• A Worked Example: Continuity Planning for a Small Diss Business
• Step 3: Write the Plan, Including Roles, Contacts and Communication
• Step 4: Test the Plan and Keep It Up to Date
• Getting Support With Your Continuity Plan From Ibertech Solutions
• Frequently Asked Questions

How to Build a Business Continuity Plan in Norfolk

Last Updated: November 8, 2026

What a Business Continuity Plan Is and Why Norfolk Firms Need One

A business continuity plan is a written document that sets out how your business will keep running, or get back to running, after something goes wrong. At Ibertech Solutions, we help local firms think through these plans, and this guide walks you through building one step by step.

Disruption comes in many forms. A flooded premises, a power cut, a broken server or a sick member of staff can all stop work overnight. A plan turns a panic into a checklist.

Here’s the thing most people miss: you don’t need a 50-page document. A few clear pages that answer three questions do the job. What could stop us? What must we keep running? Who does what when it happens?

For Norfolk businesses, the case is practical. The Norfolk Resilience Forum and North Norfolk District Council have published a 10-minute business continuity plan designed for small and medium-sized businesses to prepare for, respond to and recover from emergencies. Norfolk Resilience Forum and North Norfolk District Council business continuity plan It’s a useful starting point if you’ve never written one before.

Step 1: Identify the Risks and Disruptions Your Business Faces

Start by listing what could realistically interrupt your work in Norfolk. Don’t aim for every possible event. Focus on the ones that are likely or would hurt the most.

Common disruptions for small firms include:

• Severe weather, such as flooding or storm damage to your premises
• Power or utility failure, which can take out phones, tills and internet
• IT failure or cyber incident, including ransomware and lost data
• Staff absence, from illness or travel problems
• Supplier failure, when a key partner can’t deliver
• Loss of access to your premises, for any reason

For each risk, ask two quick questions. How likely is it? And how bad would it be for us? Score each one from 1 to 3 and focus your effort on the high scores.

Tip: Think about your own location. A business near a river has different flood risks from one on a business park. Be specific.

Norfolk-specific risks deserve special attention. Our IT security compliance guide for Norfolk businesses explains the security and compliance obligations that apply to local firms. Local flood and severe weather risks vary across the county, so tailor your list to your postcode. Check current flood warnings through the official Environment Agency flood warning service (Flood alerts and warnings).

Watch out: Don’t overlook transport disruption. Rural roads and transport links can be disrupted by snow or flooding. If your staff or customers rely on these routes, include them in your risk assessment.

Step 2: Run a Business Impact Analysis and Set Recovery Priorities

A business impact analysis (BIA) tells you what matters most. It shows which activities you must restart first and how long you can survive without them.

Work through these points for each key activity:

• What does this activity do for customers or income?
• How long can we go without it before serious harm?
• What does it depend on, such as people, systems, suppliers or premises?

This gives you two numbers to record. The first is your recovery time objective (RTO), the maximum time an activity can be down. The second is your recovery point objective (RPO), how much data you can afford to lose, measured in time. For example, “we can lose no more than one day of orders.”

Keep the list short. Five to ten essential activities is usually enough for a small business.

To make this concrete, consider a worked example for a small Diss business. Imagine a five-person accountancy office in Diss. The owner, Sarah, runs through the steps.

Her top risks are a flooded office, a broken internet line and a staff member off sick during tax season.

Her BIA shows that client email, the accounting software and phone calls are the essential activities. Client email has an RTO of four hours. The accounting software has an RPO of one day, because the cloud backup runs each night.

Her plan then says: if the office is unusable, staff work from home using the cloud software and a mobile hotspot. Calls are forwarded to a mobile. Sarah tells clients by email and a message on the website.

This is a plan you can write in an afternoon, and it covers the situations most likely to hit her business.

Watch out: Many small firms set unrealistic RTOs without checking whether their IT provider can actually meet them. If your backup runs overnight, an RPO of one hour is impossible. Align your objectives with what your systems and suppliers can deliver.

A Worked Example: Continuity Planning for a Small Diss Business

Imagine a five-person accountancy office in Diss. The owner, Sarah, runs through the steps.

Her top risks are a flooded office, a broken internet line and a staff member off sick during tax season.

Her BIA shows that client email, the accounting software and phone calls are the essential activities. Client email has an RTO of four hours. The accounting software has an RPO of one day, because the cloud backup runs each night.

Her plan then says: if the office is unusable, staff work from home using the cloud software and a mobile hotspot. Calls are forwarded to a mobile. Sarah tells clients by email and a message on the website.

This is a plan you can write in an afternoon, and it covers the situations most likely to hit her business.

Step 3: Write the Plan, Including Roles, Contacts and Communication

Now bring it together in one document. Keep it simple enough that someone else could follow it on a bad day.

Include these sections:

• Purpose and scope: what the plan covers
• Essential activities and recovery priorities: from your BIA
• Response steps: what to do first, second and third for each risk
• Roles and responsibilities: who makes decisions and who does what
• Emergency contacts: staff, suppliers, insurers, utilities and your IT provider
• Communication plan: how you will tell staff, customers and suppliers

Store the plan in more than one place. If you’re writing yours from scratch, our step-by-step guide to building an IT disaster recovery plan walks through each section. Keep a printed copy off site and a digital copy that staff can reach from home. A plan stuck on a server that’s down is no use at all.

Watch out: Many plans fail because the contact list is out of date. Check the numbers every quarter.

Step 4: Test the Plan and Keep It Up to Date

A plan you’ve never tested is a guess. Run a simple exercise once or twice a year. Gather the key people around a table, describe a scenario such as “the office is closed tomorrow”, and talk through each step. Note what was unclear or missing.

Review the plan after any real incident, after a change in staff or systems, and at least once a year. For a deeper look at testing and ongoing review, see our managed IT disaster recovery planning guide. Update the contacts, the recovery priorities and the risk list each time.

Measure how ready you are by asking simple questions. Can every staff member find the plan? Has the backup been restored successfully in the last six months? Do you know who to call first?

Getting Support With Your Continuity Plan From Ibertech Solutions

Many of the hardest parts of a continuity plan involve IT: backups, remote access, email and recovery times for systems. This is where Ibertech Solutions can help. Our Diss-based team offers IT support with 24/7 service availability and flexible virtual and on-site options. We can help you identify which systems matter most, set up backups that match your recovery objectives, and make sure your team can keep working if the office isn’t available.

Start by reviewing the IT side of your plan this week. Our IT disaster recovery support in Diss page sets out how we help local businesses with recovery and continuity planning. Then book a conversation with us about putting the rest in place. Contact Ibertech Solutions to talk through your continuity planning and get your business ready for whatever comes next.

Frequently Asked Questions

What should a business continuity plan include?

A business continuity plan should cover the risks your business faces, the activities that must keep running and how quickly they need to recover, the people responsible for each task, and up-to-date emergency contact details. It should also set out how you will communicate with staff, customers and suppliers when normal channels fail. Keep the document short enough to use under pressure, and store copies both digitally and in print so they remain accessible during an IT outage or power failure.

How do I write a business continuity plan for a small business?

Start by listing your critical activities and the systems, premises, suppliers and staff each one depends on. Then identify the most likely disruptions, such as flooding, power failure or a cyber incident, and write down a simple response for each. Assign a named person to every action and record how long you can operate without each function. A sole trader or microbusiness can use a one-page version of this approach, updated every few months.

How often should a business continuity plan be reviewed and tested?

Review your plan at least once a year and whenever something significant changes, such as a new premises, new IT systems or a change in key staff. Test it through a tabletop exercise, where the team talks through a realistic scenario, so you find gaps before a real emergency does. Record what you learn after each test and update the plan so the next version reflects those lessons.

Who should be responsible for a business continuity plan?

A named owner, usually a director or operations manager, should be accountable for the plan and its review. Each team member should also know their specific role in an incident, such as contacting customers or restoring data backups. Make sure at least two people know how to activate the plan in case the owner is unavailable, and keep their contact details in the emergency section.