Business Continuity Plans should:

• Establish a succession plan. If possible, appoint at least
  three successors for each leadership position. Consider the
  possibility that some leaders will be absent or unable to act.

• Grant emergency authority. Give leaders the authority to
  perform specified duties during disasters and emergencies
  and to re-delegate limited authority when necessary.

• Specify emergency steps. Develop all the steps, to-do lists,
  checklists, and procedures that will be needed to ensure rapid
  response, recovery, and continuity. Establish a procedure to
  locate, notify, alert, and recall key personnel. Also specify
  emergency duty locations and the responsibilities and
  assignments that must be carried out.

• Designate a primary control center. Select an emergency
  control center that can be used to manage operations
  during a disaster or emergency.

• Select a secondary control center. Choose an alternative
  emergency control center in case the primary control
  center cannot or should not be used.

• Identify backup facilities. Identify backup facilities that allow
  departments, agencies, and other emergency functions to
  continue working during a disaster or emergency.

• Secure vital records. Develop the procedures needed to select,
  preserve, and provide the records that will be needed to ensure
  that your organization is able to function during an emergency
  and to continue operations without difficulty. Financial records,
  data files, personnel documents, and engineering drawings are
  examples of the kinds of things that should all be protected.

• Protect your resources. Develop plans and procedures
  to protect your people and facilities during a disaster or
  emergency and to allocate and deploy the resources that
  will be needed in order to restore and maintain operations.
  Make sure that you’ve got the ability to relocate, replicate,
  or access redundant resources. And make sure that you’ve
  got the ability to teach people about what kinds of protective
  measures should be taken.

The above is based on NFPA 1600 2007 Annex A.5.8.3.8.

RELATED RESOURCES

How to Perform an Impact Analysis

How to Perform a Risk Assessment

Risk and Business Continuity Guide

How to Develop a Mitigation Strategy

How to Develop a Prevention Strategy

ISO 45001 2018 Health and Safety Guide

ISO 31000 2009 Risk Management Guide

ISO 22301 2019 Business Continuity Guide

ISO IEC 20000-1 Service Management Guide

ISO 28000 2007 Supply Chain Security Guide

ISO 27001 and 27002 Information Security Guide

ISO 14971 Medical Device Risk Management Guide