Business continuity plan for a one-person business, with a free template

A business continuity plan for a one-person business answers a narrow question: if you could not work for three weeks starting tomorrow, what would break first, and who would notice? In a bigger company, a colleague picks up the phone. When you are the whole company, the answers live in your head, your inbox and your password manager.

The fix is a short written runbook and one person you trust to use it. This guide covers what goes in it, how to choose that person, and what never to write down.

Two plans are easy to mix up:

• A digital estate plan is about what your family needs after you die: accounts, documents, who inherits what. Our digital estate checklist for solo founders covers that.
• A business continuity plan is about keeping the business running and customers served while you are out, whether that is a surgery, an accident or a family emergency.

The SBA's recovery planning guidance says a business continuity plan should identify and document critical business functions and processes, organize a business continuity team, and evaluate recovery strategies. For a one-person business, the "team" is you and one stand-in, and the "processes" are a list you can write in an afternoon.

One section per area, one line per item: what it is, where it is, its renewal or due date, and what your stand-in should do first.

Start with cash flow, because it is what stops first.

1. List every account that holds or moves business money: checking, savings, cards, and every payment processor or marketplace.
2. Note where each payout lands and how often.
3. List recurring bills charged to the business: tools, hosting, insurance premiums, contractor payments.
4. Write down what a stand-in may and may not do. Pausing a subscription or answering a client is very different from moving money. If someone should be able to act on your accounts while you are alive but unable to, that is a legal question for an attorney, not something a shared login solves.

Ask your bank what it allows for your account type, such as an additional authorized signer. The answer depends on the bank and your business structure.

Write down what keeps your product or service online and what happens if billing stops.

• Hosting and services: provider, what runs there, which card pays, and what a customer would see if it went down.
• Backups: the SBA's cybersecurity guidance says to regularly back up data on all your computers and, if possible, to back up to cloud storage on a weekly basis. Note where your backups are and when you last tested one.
• Code: where each repository lives. GitHub lets you invite a successor for your personal account's repositories. GitHub's documentation says a successor can archive your public repositories or transfer them, that successors cannot log into your account, and that an appointed successor can manage your public repositories after presenting a death certificate then waiting for 7 days, or an obituary then waiting for 21 days. It is a tool for after a death, for public repositories, not a way to keep a private codebase running while you are in the hospital.
• Business email: which address clients write to, and the phone number that receives your two-factor codes.

An expired domain can take down your website and your email at once, and the renewal reminders go to the registered name holder, which in a one-person business usually means only you.

ICANN's Expired Registration Recovery Policy applies to generic top-level domains. It requires registrars to notify the registered name holder at least two times before expiration, approximately one month and approximately one week before, and to send at least one more notice within five days after expiration if the registration is not renewed or deleted. After expiration, the policy also requires the registrar to interrupt the domain's existing DNS resolution path for a period before the name is deleted, to the extent the registry permits.

So for each domain, write down the registrar, the renewal date, the card on file, and the email address the reminders go to. If that address is on the same domain, a lapse can cut off the very email that warns you. The policy covers generic top-level domains; for any other domain, ask your registrar which rules apply.

Clients don't need your passwords. They need to hear from a person.

• Keep a list of active clients with one contact each, where the contract is, and any notice or handover terms.
• Draft a two-paragraph message your stand-in can send: what happened, what happens to the work, and when they will hear more.
• If a trusted peer could finish or hand over work, write their name down and ask them first.

Taxes keep their own calendar. The IRS says that if you are in business for yourself, you generally need to make estimated tax payments, that the year is divided into four payment periods each with a specific due date, and that if you don't pay enough tax by a due date, you may be charged a penalty. Put your accountant's name and your payment dates in the runbook, so a stand-in can at least call the accountant before a deadline.

Record the facts a stand-in or attorney would ask for first:

• Entity type and state, and where your formation documents and operating agreement are.
• Registered agent. The SBA says an LLC, corporation, partnership or nonprofit corporation needs a registered agent, who receives official papers and legal documents on behalf of the company. Note who yours is, so legal mail is not missed while you are out.
• Insurance. List each business policy, the insurer and where the policy document is. The SBA advises speaking to insurance agents about what coverage makes sense for your business.
• Will and power of attorney: where they are kept. The CFPB's guide for agents describes a power of attorney as a legal document that gives someone authority to make decisions about a person's money or property if they are sick or injured, and states that the agent's authority ends when the person dies. A runbook does not replace either document.
• Sole proprietors: the IRS says an estate that operates a sole proprietorship after the owner's death needs a new EIN, for the business. That is one more reason to talk to an attorney and an accountant before you need to.

Your stand-in is the person who keeps customers served while you are out. A good one:

• is reachable and calm, and has agreed to do it;
• understands enough of your work to answer a client and call your accountant;
• does not have to be your heir. It can be a trusted peer or contractor for the business, while family handles everything else.

Give them only the business sections: money (what comes in and goes out, not access to it), infrastructure, domains, clients and tax dates. Keep personal accounts and family matters for the people who handle your estate.

Agree on what "step in" means: answer clients, keep domains and hosting paid, call the accountant. Anything involving legal authority over your money goes through documents an attorney drafts.

The runbook should say where things are and who to call, never the secrets. A list of locations is useful to a stand-in and useless to a thief. Note which password manager you use and whether it has an emergency-access feature, not the master password.

Some providers have official tools for their own accounts. Use them, and note in the runbook which ones are set up:

• Google Inactive Account Manager lets you choose up to 10 people to receive some or all of your Google account data, or a notification, after your account has been inactive for a period you set.
• Apple Legacy Contact lets the people you name request your data after your death. They need both an access key and your death certificate. Data in iCloud Keychain, such as passwords and passkeys, is not included.
• GitHub successor, covered above, for public repositories after a death.

These are built for death or long inactivity, not for a three-week recovery. That gap is what the runbook and your stand-in cover.

A stale runbook is worse than none, because your stand-in will trust it.

• Review it once a year, and whenever you add a client, a domain, a bank account or a hosting service.
• Put "last checked" dates on every line.
• Check domain renewal dates and the email address that receives the reminders.
• Tell your stand-in where the current copy is, and replace old printed copies.