Workshop Resources

Workshop Resources · Plan

Build your plan

Four sessions to create a BC/DR draft. Click each chapter to open.

The plan generation is based on using the AI prompts, as building a plan is a complex task and solving the blank page problem is helpful.

If you want to attempt to write the plan yourself, the pages below outline the information that is important to collect and Step 3 contains a checklist of the sections necessary for the plan.

The intake worksheet in Step 0 will get you well on the way to developing a picture of the situation in your business. The prompts are also a good source of information.

The main things we are trying to learn are:

  • What are the critical systems of our business, from the perspective of various stakeholders?
  • What are the consequences of those systems having problems?
  • Who is our incident response team? What roles and responsibilities do they have?
  • How do we recover systems, documents, data?
  • How and when do we test and train our readiness and improve our plan over time?

Get in touch with us if you need assistance.

0 Before you start · 10–15 min BC/DR Intake Worksheet

Basic information gathered up front. Answer what you can.

Copy the worksheet as Markdown. Fill it in wherever you like, and optionally paste it into your AI tool at the start of Part 1.

1. Company basics

  • Company name:
  • One-line description of what we do:
  • Industry / sector:
  • Total headcount:
  • Engineering/technical headcount:
  • Website URL:

2. What already exists

  • Do we have an existing IR, on-call, or disaster recovery doc? Y / N — if yes, attach it.
  • Do we have a status page or external incident comms channel? Y / N — where:
  • Do we have an internal incident channel (Slack, Teams, etc.)? Y / N — name:
  • Last time we had an incident that needed cross-team response:

3. Past incidents (1-2 lines each, no detail needed yet)

  1. 1.
  2. 2.
  3. 3.

4. Critical systems

List 3-6 systems or dependencies where an outage or breach would be severely impacting our business (a P1/P2):

  1. 1.
  2. 2.
  3. 3.
  4. 4.
  5. 5.
  6. 6.

5. Role coverage

Fill in a name next to each role. Write “no clear owner” if there isn’t one.

RoleName
Incident Commander
Public Information Officer
Liaison Officer
Safety Officer
Operations Section Chief
Planning Section Chief
Logistics Section Chief
Finance Section Chief

6. Stakeholder list (10-15 people)

This is a list of people who will receive a questionnaire about company readiness in the next part.

Aim for a mix of technical and business roles — CTO, CISO, engineering leads, product, ops, customer support lead, etc.

NameRoleEmail/Slack
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.

7. Deadline

Date responses are due back to you: ____________

1 Part 1 · 20–30 min Build your context

By the end of this part you'll have a business summary, your team mapped onto incident-response roles, your own P1–P4 severity scale, and a survey ready to send to 10–15 colleagues.

Copy the prompt below and paste it into your favourite AI tool, with the worksheet from the previous step attached. Also attach the incident severity matrix template.

You will then go through the following steps:

Step 1 – Company basics

Covered by your intake worksheet.

Step 2 – Business summary

The AI drafts a 150–200-word summary of what the business does, who its customers are, and what's technically critical — from your website. Your job is to correct it until it's true.

Step 3 – Map your people to IR roles

Map your people onto the ICS-style roles: Incident Commander, Public Information Officer, Liaison, and the four Section Chiefs. One person may hold 2–3 roles — and any role with no owner gets flagged, which is the point.

Step 4 – Your severity scale

Draft your own P1–P4 severity scale from your actual systems and customer impact, not generic examples. The severity matrix in Respond is the reference; this step localises it.

Step 5 – The scenario survey

The main deliverable of Part 1: a short standalone survey (the "Scenario Export Prompt") to send to the 10–15 colleagues on your worksheet list. Each names their top 3–5 incident scenarios — likelihood, impact, who should be in the room, and what has no plan today — in a format that merges cleanly.

If you would rather ask questions directly instead of sending a prompt, or you want to ask them in person, here are the critical questions:

– What are the 3-5 top incident scenarios you personally worry about, specific to your part of the business?

– For each scenario, what is the likelihood of it happening (low/medium/high), the impact of it happening, and who they think should be in the room to fix it?

– Which of these scenarios, should they happen, do we have no recovery plan for today?

Attach these questions to an email and include the deadline from the worksheet.

Step 6 – Wait

Stop here. Send the survey, set the deadline from your worksheet, and let the replies trickle in over the next few days.

2 Part 2 · 15 min, a few days later Merge the responses

Ten to fifteen replies are in. Go back to the same conversation as Part 1 — paste the responses in one after another, labelled by name and role. Don't start a new chat.

Synthesise one scenario list

Combine all the responses into one deduplicated, ranked list of incident scenarios, plus:

  • a parking lot of "we have no plan for this" items
  • where people disagreed on severity or ownership — and where that's a problem worth resolving before it's real
  • the top 3 scenarios to run tabletop exercises on first
3 Part 3 · 15 min Draft the plan

Everything so far — the business summary, the severity scale, the role mapping, the scenario list — becomes a working first draft of your BC/DR plan. Eight sections.

Draft the 8-section plan

The plan, section by section:

  • purpose & owner
  • scope — which systems, teams, locations
  • emergency contacts
  • the disaster-recovery team per top scenario
  • a first-hour run-sheet for your top 3 scenarios
  • a measurable "restored" definition per critical system
  • backup locations & recovery objectives
  • a test-and-review cadence

Read through the draft and correct anything necessary.

The disaster recovery plan's eight sections, as a checklist
The eight sections, as a checklist — the shape of the plan you're about to draft.

That's a working BC/DR draft. Save it somewhere your team can find it, put the review cadence on a calendar, and go to Respond next.