Your BIA says what's critical. This plan says how it recovers: who activates, who commands, what recovers in what order, and what gets said to whom, written to be opened in minute five of a bad day, not filed for the auditor.
Most continuity plans are aspirational documents, RTOs nobody has proven, contact lists nobody has dialed, procedures written by someone who's never run them. This template is structured around evidence: every recovery procedure records the last tested result next to the stated objective, every activation step has a name and a clock, and the completed examples show what honest entries look like, including the gap between a 2-hour RTO and a 3-hour proven failover, and what the plan says to do about it.
Severity-keyed activation criteria, three named activation authorities, a T+0 → T+2:00 escalation timeline, and stand-down rules.
Incident Commander, Comms, Ops, Legal/Compliance, Scribe, Executive Liaison, matching the Tabletop Playbook, so you exercise the same structure you'll run.
Recovery order falls out of the BIA's criticality tiers, the same tier model as the PivotRisk BIA workbook, so the two documents snap together.
A fillable per-process template (profile, steps, workaround, dependencies, minimum staffing, validation) with two completed, realistic examples.
Audience matrix, three holding-statement templates, and a regulator notification table, drafted before the bad day, when drafting is cheap.
A tier-driven testing schedule, change-triggered maintenance rules, version control, and appendices: rosters, battle box, compliance mapping.
The thinking: Your BIA Is a Shelf Document and Incident Command Is the Backbone of Resilience.
A 30-page Word document (.docx) plus a PDF reference version. Every table is editable; fill prompts mark exactly what you replace.
No, but they're designed as a pair: the BIA produces the tiers and recovery objectives this plan consumes. If you already have a BIA, map your tiers onto the plan's tier table and everything else follows.
The structure maps to ISO 22301's continuity requirements, DORA Art. 11 response & recovery, FFIEC BCM, and NIST SP 800-34, citations are in the compliance appendix. Filling it honestly is what makes it evidence; scope your own obligations to confirm coverage.
Yes, internally or in client engagements. You can't resell the template itself as a template.
Activation, command, priorities, procedures, and words for the worst day, decided in advance.