What is BCP | 5 Basics Small Businesses Should Know for Business Continuity

BCP stands for "Business Continuity Plan," and it refers to plans and preparations for small businesses to continue operations without interruption even during emergencies such as natural disasters, pandemics, cyberattacks, or large-scale power outages.

In this article, we organize the meaning, countermeasures, and development process of BCP as 5 logical and practical basics for small business owners, sole proprietors, and SOHO managers.

We provide the materials necessary to judge based on your company's size, industry, and budget, without relying on external templates or forms, to answer basic questions like "What is BCP?", "Does my company need a BCP?", and "Where should I start?"

※ This article is a summary created based on public information and guidelines from the Small and Medium Enterprise Agency, the Ministry of Economy, Trade and Industry, the Tokyo Chamber of Commerce and Industry, and others.

What is BCP | Basics of Business Continuity Planning

Official Name and Meaning of BCP

• BCP: Business Continuity Plan

• Japanese: Business Continuity Plan

• Purpose: Plans and preparations to continue and quickly restore core business operations even when facing emergencies such as natural disasters, accidents, infectious diseases, or cyberattacks

• Target: From large corporations to small businesses and sole proprietors, development is recommended regardless of size

Differences Between BCP and Similar Terms

We will clarify similar terms that are often confused by managers and practitioners.

BCP (Business Continuity Plan)

• A plan and preparation to continue business even during emergencies

• Includes normal-time preparations + emergency response + recovery phases

BCM (Business Continuity Management)

• Comprehensive management activities including continuous improvement and operation of BCP

• BCM is the 'mechanism for running a BCP (plan)'

BCM = BCP + Operation + Improvement is the relationship.

Disaster Prevention Plan

• A plan specialized for natural disasters

• Focuses on protecting human life

• Included as a component of BCP

Business Continuity Enhancement Plan

• A public system certified by the Small and Medium Enterprise Agency / Business Continuity Enhancement Plan Certification System (Official Small and Medium Enterprise Agency)

• Receiving certification offers benefits such as tax incentives, subsidy points, and low-interest loans

→ Once a BCP is formulated, it is also possible to apply for certification as a Business Continuity Enhancement Plan is the flow.

Why BCP is necessary for small and medium-sized enterprises | Differences from large companies

There is an image that 'BCP is for large companies,' but I will organize the reasons why small and medium-sized enterprises are the ones that need BCP the most.

① Small and medium-sized enterprises are more prone to business collapse during emergencies

Large companies ensure redundancy through multiple locations, multiple business partners, and abundant funds, but small and medium-sized enterprises operate with one location, few business partners, and limited funds.

• One major business partner is hit by a disaster → Possibility of losing more than half of sales

• One location is hit by a disaster → All operations stop

• One manager is absent for a long period → Decision-making stops

→ The essence is to compensate for the lack of redundancy with BCP planning and preparation.

② Increase in 'BCP requests' from business partners and financial institutions

In recent years, cases where BCP formulation is a condition for doing business with large companies are increasing.

• Major companies in the automotive, electronics, and food industries → Supply chain BCP requirements

• Financial institutions → BCP status is now an evaluation item in loan screening

• Government bidding → Certification of Business Continuity Enhancement Plan is a point-adding factor

→ We are in an era where "the presence or absence of a BCP is directly linked to business opportunities, financing, and public contracts."

3. "Business continuity capability" in the recovery phase creates management differences

The recovery speed after an emergency determines subsequent business continuity.

• With BCP: Major operations resume in 1-2 weeks → Business maintained

• Without BCP: Suspension for over a month → Business termination/customer loss → Risk of bankruptcy

Following the Great East Japan Earthquake and the COVID-19 pandemic, companies with a BCP tended to have a higher business continuity rate after emergencies as pointed out by the Small and Medium Enterprise Agency and various research organizations.

4. Preparation for "what happens if something happens to me" for business owners

For SMEs, a BCP also functions as preparation for sudden illness, accidents, or death of the business owner in addition to disasters.

• Clarifying decision-making authority in the absence of the owner

• Establishing handovers for important documents, contract information, and passwords

• Pre-designating successors or proxies

→ In the case of SMEs, "risks to the individual business owner" are also important elements that should be prepared for with a BCP.

5 Basic Components of a BCP

A BCP for SMEs consists of the following 5 basic elements. If you organize these in order, a minimum viable BCP will be completed.

Basic 1: Risk Analysis | Anticipating what might happen

List the risks your company may face and probability of occurrence × degree of impact to prioritize them.

Major Risks

• Natural Disasters: Earthquakes, floods, typhoons, heavy snow

• Accidents/Failures: Fires, power outages, communication failures, IT failures

• Infectious Diseases: Pandemics, mass infections

• Cyber Attacks: Ransomware, data leaks, unauthorized access

• Human Risks: Sudden illness, resignation, or accidents involving management or key personnel

• Business Partner Risks: Bankruptcy or disaster damage to major business partners

• Economic Risks: Rising raw material costs, exchange rate fluctuations

How to prioritize:

• High impact × High probability → Highest priority measures

• High impact × Low probability → Secondary priority measures (prepare with insurance, contracts, etc.)

• Low impact × High probability → Absorb through normal operations

• Low impact × Low probability → Postpone

Basic ② Identification of Core Business | Deciding "tasks that must never be stopped"

In an emergency, decide in advance what to prioritize with limited resources.

3 questions to identify core business

1. What percentage of sales does this operation generate?: Which operations generate the top 80%?

2. Is it an operation that supports the trust of business partners and customers?: The magnitude of trust lost if stopped

3. Is it an operation with a legal or contractual obligation to continue?: Medical, infrastructure, public contracts, etc.

→ Use these questions to narrow it down to about 3 core businesses. You can then make the decision to systematically scale down or stop the rest during an emergency.

Basic 3: Preparation of Countermeasures | Concrete Preparations for Business Continuity

Prepare the physical and organizational preparations necessary to continue core business operations.

Physical preparations

• Power: UPS, portable power supplies, emergency generators

• Communication: Multiple lines, mobile Wi-Fi, satellite communication

• Data: Backups (cloud, NAS), redundancy

• Business continuity infrastructure: NAS, servers, business systems

• Alternative office space: Remote work, satellite offices

• Stockpiling materials: Raw materials, parts, water, food

Organizational preparations

• Emergency contact network

• Rules for delegating decision-making authority

• Safety confirmation system

• Notification procedures for business partners

Basic 4: Establishing a Structure | Deciding Who Does What

Determine the command structure and role assignments for emergencies during normal times.

• Composition of the Disaster Response Headquarters: Head, Deputy Head, and functional leads

• Order of succession: Order of decision-making authority in the absence of the Head

• Communication network: Contact routes for employees, business partners, government, and financial institutions

• Role manual: List of tasks for each person in charge

Basic 5: Training and Improvement | Keeping the Plan 'Ready to Use'

A BCP only functions if it is regularly trained and improved, rather than just created and forgotten.

• Regular training: Tabletop and practical exercises 1-2 times a year

• Review: Annual review based on personnel changes and business environment shifts

• Education: Thorough awareness for new employees and executives

• Continuous improvement: Post-training review and plan revision

How to Develop a BCP for SMEs | 5 Practical Steps

We will organize the order in which SME owners and managers should start.

Step 1: Risk Assessment of Your Company

SME Agency's BCP Formulation and Operation Guidelines, referring to public guidelines, summarize the risks that could occur based on your industry, size, and location on a single sheet of A4 paper.

Step 2: Identification of Core Businesses

Narrow down the 'tasks that must never stop' to no more than three. Sharing this within the company will speed up priority decision-making during emergencies.

Step 3: Development of Basic Measures

Establish minimum preparations based on the four pillars of power, communications, data, and personnel to support core business operations. Specific measures are organized in detail in [BCP Measures for SMEs: 5 Business Infrastructures to Keep Operations Running].

Step 4: Establishing Systems and Communication Networks

Establish command chains, delegation rules, and communication networks for emergencies and share them with employees and relevant parties.

Step 5: Training and Improvement

Conduct training 1-2 times a year and improve the plan through reviews. A "non-functional BCP" is meaningless, so develop it into a "usable BCP" through training.

Benefits of "Business Continuity Enhancement Plan" Certification

Once you have formulated a BCP, consider obtaining the Small and Medium Enterprise Agency's"Business Continuity Enhancement Plan" certification.

Benefits of Certification

• Tax Incentives: Special depreciation for specific equipment (disaster prevention/mitigation equipment, etc.)

• Financial Support: Low-interest loans from the Japan Finance Corporation

• Subsidy Bonus Points: Additional points in screenings for Monodzukuri subsidies, etc.

• Non-life Insurance Discounts: Discounts available at some insurance companies

• Certification Mark for PR: Can be used on company websites, business cards, etc.

Certification Process

1. Create a "Business Continuity Enhancement Plan" based on the BCP

2. Apply to the competent Regional Bureau of Economy, Trade and Industry

3. Receive various benefits after certification

By utilizing the Small and Medium Enterprise Agency's public formats and support organizations, application is possible even without experts.

Specific BCP Measures: Business Infrastructure and Disaster Stockpiling

For SME BCPs, the most practically important preparations are the following two axes.

Development of Business Infrastructure (Physically supporting business continuity)

• UPS (Uninterruptible Power Supply): APC SMT1500J / APC BR550S-JP / CyberPower SX550UJP, etc.

• Business NAS: Synology DS224+ / QNAP TS-464 / Buffalo TeraStation, etc.

• Business Wireless LAN: Synology RT6600AX / Aterm 19000T12BE, etc.

For more details, please see the magazine Selecting Business Infrastructure Equipment to Support 'Non-Stop' Operations On-Site and on the Web.

Disaster Prevention Stockpiling (Supporting business continuity in emergencies)

• Portable Power Station: EcoFlow DELTA 3 / Anker Solix C1000 Gen 2 / Jackery Series

• Satellite Communication: Garmin inReach Mini 3 Plus

• Emergency Radio: SONY ICF-B300 / SONY ICF-B99

• Water Purifier: KEIYO AN-S152

For more details, please see the magazine Preparing in Earnest. Tools to Protect 'Daily Life' from the Fury of Nature and Disasters.

Common Patterns of Failure in BCP Formulation for SMEs

Failure Pattern 1: Aiming for a 'Perfect BCP'

Rather than getting discouraged by aiming for a 100-page BCP, it is far more effective to start with a practical BCP of about 10 A4 pages.

Failure Pattern 2: Copying Templates Directly

Templates from the Small and Medium Enterprise Agency and Chambers of Commerce are convenient, but copying them without reflecting your company's industry, scale, and risks will not work in an emergency.

Failure Pattern 3: 'Create and Forget'

20% of a BCP's value is realized at the time of creation, and the remaining 80% is realized through training and improvement. Please be sure to plan for training 1-2 times a year.

Failure Pattern 4: No Scenario for the Absence of Management

The biggest risk for SMEs is the sudden illness or accident of the business owner. Please be sure to include decision-making authority in the absence of management in your plan.

Failure Pattern 5: Ignoring Digital and Cyber Risks

In recent years, ransomware and data leaks have been hitting SMEs directly. Please be sure to include cyber measures in addition to physical preparations.

Frequently Asked Questions (FAQ)

Q1. Is BCP mandatory by law?
A. There is no legal obligation for general companies. However, it is recommended or mandatory for specific industries such as medical, nursing care, infrastructure, and finance. Additionally, cases where BCP formulation is requested by major business partners are increasing.

Q2. What is the difference between BCP and BCM?
A. BCP = 'Plan/Preparation', BCM = 'Management activities including continuous operation and improvement of BCP'. BCM is a comprehensive concept that encompasses BCP.

Q3. Is BCP necessary for sole proprietors?
A. Yes, it is. In fact, for sole proprietors operating alone, preparing for 'when something happens to me' is the key to business continuity. A simplified version of a BCP is sufficient.

Q4. How much does it cost to develop a BCP?
A. If you create it in-house, the cost is almost zero. If you hire an external consultant, it can range from 300,000 yen to several million yen depending on the scale. Using the public formats provided by the Small and Medium Enterprise Agency makes in-house creation a realistic option.

Q5. Where should I start?
A. Start with the 3 steps of Risk Assessment → Identifying Core Business → Preparing Countermeasures. Specific countermeasures are detailed in [BCP Measures for SMEs | 5 Business Infrastructures to Keep Operations Running].

Q6. How often should the BCP be reviewed?
A. An annual periodic review + improvements after drills is the standard. Reviews are also necessary whenever there are major changes such as shifts in the business environment, personnel changes, or new business transactions.

Q7. What is the relationship with the Business Continuity Enhancement Plan certification?
A. Once you develop a BCP, you can apply for certification as a "Business Continuity Enhancement Plan." Obtaining this certification provides public benefits such as tax incentives, low-interest loans, and additional points for subsidies.

Q8. What should I prepare for disaster stockpiles?
A. Power (portable power stations), communication (satellite devices), information (emergency radios), water (water purifiers), and food (emergency rations) are the 5 pillars, with a minimum of 3 days' supply as a guideline. Details are organized in the Serious Preparation Magazine.

Q9. How should I prepare for business data backups?
A. Redundancy using Cloud + Business NAS is the basic approach. Business NAS for SMEs is explained in detail in articles such as QNAP TS-464 and Synology DS224+.

Q10. What kind of BCP drills should I conduct?
A. Combine two types: "Tabletop exercises" (scenario-based discussions) and "Practical drills" (practicing the actual activation of the BCP). It is realistic to start with one tabletop exercise per year.

Summary | The correct approach for SME BCP is "simple and practical"

BCP is a plan and preparation for SMEs to continue operations without stopping even in emergencies. Rather than aiming for a perfect 100-page BCP, an approach of creating a simple and practical BCP of about 10 A4 pages and growing it into a "living BCP" through 1-2 drills per year is more suited to the reality of SMEs.

5 actions you can start today

1. Summarize your company's risks on one A4 sheet

2. Narrow down core business activities to 3 or fewer

3. Establish basic measures across the 4 pillars of power, communication, data, and personnel.

4. Establish emergency contact networks and delegation rules.

5. Plan for annual drills.

Specific steps for developing business infrastructure are organized in [BCP Measures for SMEs: 5 Types of Business Infrastructure to Keep Operations Running], and how to choose disaster prevention stockpiles is covered in the Serious Preparation magazine.

For business owners who think, "I want to start a BCP, but I don't know where to begin," please start by applying the 5 basics in this article to your own company.

Related BCP articles you may also want to read

Magazine | Business Infrastructure and Disaster Prevention Stockpiles

Specific equipment selection for business infrastructure is explored in Business Infrastructure Equipment Selection to Support 'Non-Stop' Operations On-site and on the Web, and disaster and emergency preparedness is delved into in the Serious Preparation: Tools to Protect 'Daily Life' from the Fury of Nature and Disasters magazine.