A business continuity communication plan says who you must tell what during a disruption, through which channel, by when, and who signs off. Its audience is everyone you need to keep operating: staff, customers, suppliers, regulators, your landlord, your insurer, your bank. The goal is that the night shift knows where to report, the largest customer knows which orders will ship, and the regulator hears from you before the deadline.
That is what separates it from media relations. Reporters, social media and public statements belong to the crisis communications plan, covered in our guide to writing a crisis communications plan before the cameras arrive. The two plans share contact lists and approvers and must never contradict each other, but they do different jobs. This one covers the operational side.
What the plan contains
Five parts, short enough to print:
- An audience matrix: who, what they need, channel, owner and timing.
- Message drafts for each audience, with blanks for the facts.
- A channel ladder for when email, the phone system or the corporate network is down.
- An approval flow sized to the risk of each message.
- Contact data, each list with an owner and a refresh date.
The audience matrix
The matrix is the core of business continuity communication. Every row needs an owner named before the event, holding contact details that work when the office does not.
| Audience | What they need | Channel (primary, then fallback) | Owner | Timing |
|---|---|---|---|---|
| Staff on site | Safety instructions, where to go | Alarm and PA, mass text; wardens, two-way radios | Incident lead | Immediately |
| All staff | Whether to come in, where to work, pay and hours | Mass notification; manager call tree | HR | Within 1 hour, then at set times |
| Managers and shift leads | Fuller picture, which decisions are theirs, what to tell teams | Bridge call; text group | Incident lead | Before the all-staff message |
| Key customers | Impact on their orders, the workaround, next update | Account owner by phone; personal mobile | Sales lead | Within 2 to 4 hours |
| Other customers | Service status, how to order or get help | Website notice; status page on separate hosting | Customer service lead | Same day |
| Critical suppliers and carriers | Hold, redirect or bring forward deliveries; new receiving contact | Buyer by phone; email from a separate account | Procurement | Within 4 hours |
| Regulators and examiners | Facts, impact, actions, contact person | Named contact by phone, then in writing | Compliance | Per rule or contract |
| Landlord or property manager | Access, damage, building systems, security | Property emergency line | Facilities | Within 1 hour if the building is involved |
| Insurer or broker | Notice of a possible claim, steps taken to limit loss | Broker by phone, then written notice | Finance | Within 24 hours, or as the policy requires |
| Bank and lenders | Payroll and payment runs, covenant questions | Relationship manager | Finance | Same day if payments are affected |
| IT provider and key SaaS vendors | Your restoration priorities | Vendor incident line | IT lead | Immediately for IT events |
| Temps, contractors, visitors | The same safety and attendance instructions as staff | Agency contact, host employee | HR | With the all-staff message |
The times are targets; your business impact analysis sets the real ones. A customer that runs on daily deliveries needs its call in the first hour.
Message drafts to write now
Draft each message before you need it, clear it once with whoever approves it, and store the drafts where a phone can reach them without the corporate network. What each one has to carry:
Staff instructions
The first staff message answers four questions in a few lines: is everyone safe, should I come in, where do I work instead, and when is the next update. A typical draft says the Elm Street office is closed today because of a power failure, office staff work from home, warehouse staff report to the Route 9 site for the 2 p.m. shift, pay is not affected, and the next update comes at 11 a.m. Leave cause and speculation out. Then send the 11 a.m. update even if nothing has changed; a silent hour produces more calls than a two-line "no change" message.
Customers
Customer messages lead with what affects them, not with what happened to you. Say which orders, services or locations are affected, what you are doing about it (shipping from another site, taking orders by phone), what the customer can do now, and when they will hear next. Account owners calling key customers need a short script and a list of topics they should not discuss, such as credits, cause and liability, which go to one named person.
Suppliers and carriers
Suppliers need instructions, not reassurance: hold Tuesday's delivery, send it to the alternate address, or bring the next order forward. Include a new receiving contact and the date you will confirm normal terms. If deliveries move to another site, call the carrier's dispatch desk directly, because the driver will never see your email.
Regulators
Keep regulator notices factual and dated: what happened, when you became aware, which services and customers are affected, what you have done, who the contact is, and when you will update. Many sectors set deadlines and required content, so list every notification duty in the plan with its trigger and owner. Build that list with compliance, not from memory.
Landlord and insurer
The landlord needs to hear about access, damage, security and building systems such as power, water and HVAC, and you need the earliest re-entry time from them. Your insurer or broker needs early notice of a possible claim and a record of what you did to limit the loss. Where it is safe, photograph damage before cleanup starts.
Return to normal
Write the all-clear too: when and where staff report, which customer orders were delayed, and when normal delivery terms resume.
When email or phones are down
Every channel depends on something. Map each one against your likely disruptions, and make sure each row of the matrix has two channels that fail for different reasons.
| Channel | Depends on | Fails when |
|---|---|---|
| Corporate email and chat | Network, identity provider, endpoints | Cyber incident, endpoint failure, identity outage |
| Desk phones | Phone system, building power and network | Site loss, power cut, phone platform outage |
| Mass notification | Vendor platform, contact data, mobile carriers | Stale data, carrier filtering, wide mobile outage |
| Personal mobiles | Mobile network, phone battery | Regional power cut once cell site batteries run down |
| Status page or dark site | Separate hosting, someone able to update it | Hosting shared with the main website |
| Two-way radios | Charged batteries, range | Large or multi-floor sites, nowhere to charge |
| Notices, runners, assembly points | People and pre-agreed places | Very little, which is the point |
Our guide to what to test in a mass notification system covers the platform side: contact data, carrier filtering, sender access and two-way polling. The rest of the ladder is old-fashioned and worth keeping. The July 2024 CrowdStrike outage, covered in our incident explainer, is the standing example of why company laptops cannot be the only path to staff.
Two rules settle most fallback questions. First, agree a default for when nobody can be reached, such as "office staff stay home and call their manager at 10 a.m." Second, for a site that can lose its phones, keep a little equipment where the incident lead can grab it.
License-free FRS radios cover floor wardens and a yard without phones, and a power bank keeps the incident lead's phone going through a long day. Neither one replaces the call tree.
Approval flow
Approval should match the risk of the message, not the seniority of whoever happens to be around. Three tiers work for most organizations:
| Tier | Messages | Who approves | Time limit |
|---|---|---|---|
| 1. Pre-approved | Safety instructions, closures, where to report, "next update at" messages built from cleared drafts | Incident lead alone | None; send now |
| 2. Quick review | Customer service notices, supplier instructions, key customer scripts | Incident lead plus the function owner | 15 to 30 minutes, then the alternate decides |
| 3. Full review | Regulator notices; anything on cause, data, injuries or liability; anything also going to media | Incident lead, legal or compliance, communications lead | As set in the crisis communications plan |
Write the tiers into the plan with names and two alternates for each approver. Most operational messages should sit in tier 1 or 2. If every staff text needs a lawyer, it will go out late.
Keep the contact data alive
Contact data decays faster than anything else in a continuity plan. Give each list an owner and a refresh date: HR for staff, account owners for customers, procurement for suppliers, facilities for the landlord and building contractors. Check the lists quarterly and print the short version for the incident team. The communications section of our business continuity plan template asks the question every plan should answer: what staff and customers hear in the first two hours, from whom, and by which channel if email is down.
Then test it the way you would test a restore. Send the staff message from a phone with the office network unplugged, time how long the call tree takes to reach the last person, and ask three account owners to find their key customer's after-hours number without opening a laptop.
Frequently asked questions
What should a business continuity communication plan include?
An audience matrix (who needs what, through which channel, from whom and by when), pre-drafted messages for each audience, fallback channels for when email or phones fail, an approval flow, and contact lists with owners and refresh dates. Keep it short enough to print and use without a network.
How is it different from a crisis communications plan?
The continuity communication plan covers operational messages to the people you need to keep working with: staff, customers, suppliers, regulators and landlords. The crisis communications plan covers reputation, media and public statements. They share approvers and contact data, and they must say the same thing.
Who should own business continuity communication?
The incident lead decides what goes out and when, and each audience has its own owner, such as HR for staff and procurement for suppliers. The continuity manager owns the plan, the drafts and the contact data checks. Media statements stay with the communications lead.
How often should the communication plan be tested?
Test notification channels and the call tree at least twice a year, once after hours, and check contact data every quarter. Add a communication objective to every larger exercise, such as sending the first staff and key customer messages within their target times.
