# Free UK disaster recovery and business continuity plan template > A free Word and PDF template for a combined disaster recovery and business continuity plan, written for UK organisations. It covers roles and contacts, UK reporting routes, a business impact analysis, recovery targets, runbooks, communications and a test schedule. No sign-up needed. - Published: 2026-10-27 - Topic: [Backup & Recovery](https://futuretechnologyhq.com/topic/backup-recovery/) - URL: https://futuretechnologyhq.com/article/disaster-recovery-business-continuity-plan-template-uk/ - Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article. ## Key points - The template is one document with the business continuity plan wrapped around the disaster recovery plan, as AWS advises and as the NCSC's inter-linked plans suggest - It covers the NCSC's basic plan ingredients: key contacts with two contact methods each, escalation and decisions, a conference number always available for urgent incident calls, record keeping and a post-incident review - The UK reporting contacts are filled in already: the ICO's 72-hour rule, GOV.UK's report-cyber signposting service and the police reporting line - The business impact analysis comes first, because the recovery targets for each system come from the business, not from the backup software - It is a free Word and PDF download with no sign-up, and the newsletter box beside it is optional ## Article Most disaster recovery plan templates on the web are American, and most business continuity templates are long enough that nobody fills them in. This one is written for UK organisations, fits a small or medium business as well as an IT team in a larger one, and comes with the UK reporting contacts already in it. Download it, replace the square brackets, and delete the guidance notes as you go.

Download the template, free. Word to edit, PDF to read or print. No sign-up needed.

Word (.docx) PDF

Want to hear when we add tools and templates? One email a week, our free newsletter The Future Brief. Optional.

## What is in the template The template is one document, with the business continuity plan wrapped around the disaster recovery plan. AWS advises that the disaster recovery plan should be a subset of the business continuity plan rather than a standalone document, and the NCSC says an incident response plan should sit alongside inter-linked business continuity, disaster recovery and communications plans. Keeping them together helps the IT recovery order follow the business priorities, not the other way round. The sections are: 1. **Purpose and scope.** What the plan covers and the events that trigger it. 2. **Roles and contacts.** A contacts table with a deputy and a second contact method for every role, and a table of UK reporting contacts. 3. **Business impact analysis.** Each business process, its owner, its criticality tier, its maximum tolerable downtime, what it depends on and the manual workaround. 4. **Risks.** A register with ransomware, loss of a site, outages, supplier failure, hardware failure, human error and loss of key people filled in as starting rows. 5. **Systems, recovery targets and backups.** RPO, RTO, backup method, where every copy is (including the offline or immutable one) and the restore order. 6. **Disaster recovery procedures.** Who can declare a disaster, a first-actions checklist, a recovery runbook table to copy per system, and the extra rules for ransomware. 7. **Business continuity arrangements.** Premises and people, a communications plan with backup channels, manual processes and money. 8. **Return to normal.** Stand-down criteria, reconciling manual records and the post-incident review. 9. **Testing and maintenance.** A test schedule table. 10. **Document control**, plus an incident log as an appendix. ## What the NCSC says a plan needs The NCSC's guidance on incident response processes lists the ingredients of a basic plan: key contacts across the incident response team or provider, IT, senior management, legal, PR, HR and insurance, with at least two contact methods and two or more people for each; escalation criteria and a process for critical decisions; a basic flowchart or process that covers the full incident life-cycle; at least one conference number, always available for urgent incident calls; and basic guidance on legal and regulatory requirements. It says a careful record of decisions and actions is useful for post-incident reviews, especially if you need to show your response to a regulator, and that the post-incident review should cover lessons from the incident and from the response. Each of those has a place in the template. The contacts table has a deputy column and a second-contact column, there is a line for the conference number, the disaster recovery procedures name who can declare a disaster and take systems offline, and the appendix is an incident log. ## The UK reporting contacts The reporting table in section 2 is filled in with the UK routes, so nobody has to look them up during an incident: - **The ICO.** If personal data is affected and the breach is likely to pose a risk to people, the ICO says you must notify it as soon as possible and where feasible within 72 hours, a timeframe the ICO says you are legally required to meet. If the risk to people is high, you must also tell those people without undue delay. The report is an online form that the ICO says takes about 30 minutes and cannot be saved part-way, so have the details ready before you start. - **The NCSC.** GOV.UK's report-cyber service points you to the right place to report a cyber incident in the UK, Isle of Man or Channel Islands, and notes you may need to report to the ICO separately if personal data is involved. - **The police.** The template also carries the police cyber crime reporting line for England, Wales and Northern Ireland and the 101 route for Scotland, which we checked on the police reporting site on 27 October 2026. - **Your insurer.** The NCSC's ransomware payment guidance says to report an attack to your insurer or broker if you have cyber insurance. The template has a row for the policy number and claims line. Our guides to [whether you should pay a ransomware demand](/article/should-you-pay-ransomware-uk/) and to a [ransomware recovery and incident response plan](/article/ransomware-recovery-incident-response-plan/) cover the ransomware case in detail, and the second comes with its own printable checklist. ## How to fill it in **Start with the business impact analysis, not the systems.** AWS recommends a business impact analysis that quantifies the impact of a disruption on internal and external customers, and uses it to decide how quickly a workload needs to be available and how much data loss can be tolerated. Microsoft's first step is to classify workloads into tiers by their importance to the business. Fill in section 3 with the process owners in the room, then carry the tiers and the maximum tolerable downtime into section 5. **Set the recovery targets from the business numbers.** Section 5 asks for an RPO and RTO per system. Our guide to [RPO, RTO and MTD](/article/rpo-rto-mtd-explained/) explains how to set them, and the [RPO and RTO calculator](/tools/rpo-rto-calculator/) checks whether your backup schedule and restore speed can meet them. **Record where every backup copy is, including the offline one.** The NCSC says to always have a recent offline backup of your most important files and data, and that multi-factor authentication should be enabled for backups, with the MFA method not on the same device used to administer them. Section 5 has a column for the location of each copy, and the plan asks where the credentials and keys needed for a restore are kept offline. **Write the runbooks for someone who did not build the system.** AWS lists backup and restore as the lowest-cost disaster recovery strategy, and points out that it still means redeploying the infrastructure, configuration and application code. The runbook table in section 6.3 has steps for the rebuild as well as the data restore. **Keep a copy you can reach when the systems are down.** The NCSC says to consider secure or alternative communications for when normal channels are unavailable, and its payment guidance says to record decisions offline during an incident. A plan that only exists on the file server is no use when the file server is encrypted, so section 10 asks where the printed and offline copies are. **Test it.** AWS says it is critical to regularly assess and test your disaster recovery strategy so that you have confidence in invoking it. Section 9 is a test schedule with a contact-list check, a restore test from the offline copy, a table-top walkthrough, a full exercise and a yearly review. Our guide to [how often to test DR and business continuity plans](/article/how-often-test-disaster-recovery-plan/) covers what each test involves. ## Frequently asked questions ### Is the template free? Yes. Download the Word or PDF file and use or adapt it as you like. There is no sign-up and no email gate. The newsletter box next to the download is optional. ### Do I need a separate business continuity plan and disaster recovery plan? Not necessarily. AWS advises that the disaster recovery plan should be a subset of the business continuity plan rather than a standalone document, because keeping a system running does not help if the rest of the business cannot operate. The template keeps both in one document, with the IT recovery runbooks in their own section so the IT team can work from them. ### What is the difference between a disaster recovery plan and a business continuity plan? NIST defines a disaster recovery plan as a written plan for recovering information systems after a major hardware or software failure or the loss of a facility. A business continuity plan is wider: how the organisation's business processes will be sustained during and after a significant disruption, including people, premises and manual processes. ### How often should the plan be reviewed? Microsoft says business continuity planning is a process, not a one-time event, and the plan should be reviewed and updated regularly. The template's test schedule table has a row for the plan review and re-approval, so you record the frequency that suits you, and we suggest a review after any major change to systems, suppliers or people, with restore tests and walkthroughs in between. ## Sources - [Cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes) - [Mitigating malware and ransomware attacks](https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks) - [Disaster recovery plan](https://csrc.nist.gov/glossary/term/disaster_recovery_plan) - [Business continuity plan](https://csrc.nist.gov/glossary/term/business_continuity_plan) - [Disaster recovery of workloads on AWS: business continuity plan](https://docs.aws.amazon.com/whitepapers/latest/disaster-recovery-workloads-on-aws/business-continuity-plan-bcp.html) - [high availability and disaster recovery](https://learn.microsoft.com/en-us/azure/reliability/concept-business-continuity-high-availability-disaster-recovery) - [Personal data breaches: report a breach](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/) - [Report a cyber incident](https://www.gov.uk/report-cyber) - [Guidance for organisations considering payment in ransomware incidents](https://www.ncsc.gov.uk/guidance/organisations-considering-payment-in-ransomware-incidents) - [Disaster recovery options in the cloud](https://docs.aws.amazon.com/whitepapers/latest/disaster-recovery-workloads-on-aws/disaster-recovery-options-in-the-cloud.html)