Your BIA says what's critical. This plan says how it recovers: who activates, who commands, what recovers in what order, and what gets said to whom — written to be opened in minute five of a bad day, not filed for the auditor.
Most continuity plans are aspirational documents — RTOs nobody has proven, contact lists nobody has dialed, procedures written by someone who's never run them. This template is structured around evidence: every recovery procedure records the last tested result next to the stated objective, every activation step has a name and a clock, and the completed examples show what honest entries look like — including the gap between a 2-hour RTO and a 3-hour proven failover, and what the plan says to do about it.
Severity-keyed activation criteria, three named activation authorities, a T+0 → T+2:00 escalation timeline, and stand-down rules.
Incident Commander, Comms, Ops, Legal/Compliance, Scribe, Executive Liaison — matching the Tabletop Playbook, so you exercise the same structure you'll run.
Recovery order falls out of the BIA's criticality tiers — the same tier model as the PivotRisk BIA workbook, so the two documents snap together.
A fillable per-process template — profile, steps, workaround, dependencies, minimum staffing, validation — with two completed, realistic examples.
Audience matrix, three holding-statement templates, and a regulator notification table — drafted before the bad day, when drafting is cheap.
A tier-driven testing schedule, change-triggered maintenance rules, version control, and appendices: rosters, battle box, compliance mapping.
The thinking: Your BIA Is a Shelf Document and Incident Command Is the Backbone of Resilience.
A 30-page Word document (.docx) plus a PDF reference version. Every table is editable; fill prompts mark exactly what you replace.
No, but they're designed as a pair: the BIA produces the tiers and recovery objectives this plan consumes. If you already have a BIA, map your tiers onto the plan's tier table and everything else follows.
The structure maps to ISO 22301's continuity requirements, DORA Art. 11 response & recovery, FFIEC BCM, and NIST SP 800-34 — citations are in the compliance appendix. Filling it honestly is what makes it evidence; scope your own obligations to confirm coverage.
Yes — internally or in client engagements. You can't resell the template itself as a template.
Activation, command, priorities, procedures, and words for the worst day — decided in advance.