Get Instant Access
to This Blueprint

Industry Coverage icon

Develop a Business Continuity Plan for Higher Education

Streamline the traditional approach to make BCP development manageable and repeatable.

  • Recent crises have increased executive awareness and internal pressure to create a business continuity plan (BCP).
  • Higher education-driven regulations require evidence of sound business continuity practices.
  • Customers demand their vendors provide evidence of a workable BCP prior to signing a contract.
  • IT leaders, because of their cross-functional view and experience with incident management and DR, are often asked to lead BCP efforts.

Our Advice

Critical Insight

  • BCP requires input from multiple departments with different and sometimes conflicting objectives. There are typically few, if any, dedicated resources for BCP, so it can't be a full-time, resource-intensive project.
  • As an IT leader you have the skill set and organizational knowledge to lead a BCP project, but ultimately, business leaders need to own the BCP – they know their processes and their requirements to resume business operations better than anyone else.
  • The traditional approach to BCP is a massive project that most organizations can’t execute without hiring a consultant. To execute BCP in-house, carve up the task into manageable pieces as outlined in this blueprint.

Impact and Result

  • Implement a structured and repeatable process that you apply to one business unit at a time to keep BCP planning efforts manageable.
  • Use the results of the pilot to identify gaps in your recovery plans and reduce overall continuity risk while continuing to assess specific risks as you repeat the process with additional business units.
  • Enable business leaders to own the BCP going forward. Develop a template that the rest of the organization can use.
  • Leverage BCP outcomes to refine IT DRP recovery objectives and achieve DRP-BCP alignment.

Develop a Business Continuity Plan for Higher Education Research & Tools

1. Develop a Business Continuity Plan for Higher Education Phases 1-4 – A step-by-step document that walks you through the process to build BCP within the higher education industry.

Business continuity planning is a complex, interdepartmental project with multiple and sometimes conflicting objectives. Follow the guidelines in this blueprint to structure your process to streamline your efforts and stay on track.

2. Maturity Assessment and Business Impact Analysis – A structured tool to conduct and document a business impact analysis for your business continuity plan.

Use these tools to conduct a maturity assessment of your current BCP processes and do a business impact analysis to identify the gaps.

3. Process Workflows Examples – A best-of-breed template to help you build a clear, concise, and compelling strategy document for stakeholders.

The sample workflows help you establish steps, dependencies, and alternates for BCP. The tools contain multiple example workflows. Use the conventions in this tool or create your own to visually document business processes and track process requirements.

4. BCP Recovery Playbook and Roadmap – Provide additional details on BCP procedures and develop a project plan to reach your BCP goals.

Communication between the recovery teams is pivotal to make sure that BCP is conducted according to the plans. Leverage the tools and templates to make a communication plan and ensure that the improvement initiatives follow the best-practice guidelines.

Develop a Business Continuity Plan for Higher Education

Streamline the traditional approach to make BCP development manageable and repeatable.

Analyst Perspective

A BCP touches every aspect of your organization, making it potentially the most complex project you'll take on. Streamline this effort or you won't get far.

None of us needs to look very far to find a reason to have an effective business continuity plan (BCP).

From pandemics to natural disasters to supply chain disruptions to IT outages, there's no shortage of events that can disrupt your complex and interconnected business processes. How in the world can anyone build a plan to address all these threats?

Don't try to boil the ocean. Use these tactics to streamline your BCP project and stay on track:

  • Focus on one business unit at a time. Keep the effort manageable, establish a repeatable process, and produce deliverables that provide a starting point for the rest of the organization.
  • Don't start with an extensive risk analysis. It takes too long and at the end you'll still need a plan to resume business operations following a disruption. Rather than trying to predict what could cause a disruption, focus on how to recover.
  • Keep your BCP documentation concise. Use flowcharts, checklists, and diagrams instead of traditional manuals.

No one can predict every possible disruption, but by following the guidance in this blueprint, you can build a flexible continuity plan that allows you to withstand the threats your organization may face.

Photo of Frank Trovato
Frank Trovato
Research Director,
IT Infrastructure & Operations Practice
Info-Tech Research Group

Photo of Andrew Sharp
Andrew Sharp
Senior Research Analyst,
IT Infrastructure & Operations Practice
Info-Tech Research Group

Executive Summary

Your Challenge

Higher education institutes have diverse stakeholders, including staff, faculty, students, and external partners, which makes it challenging to run BCP.

Resources such as staff, training, technology, and investment are often limited, resulting in a lower priority for BCP compared to other initiatives.

Higher education runs 24/7, with many different activities. Ensuring business continuity in this environment is relatively complex.

Common Obstacles

Students' requirements and safety should be the top priority in BCP. Higher education institutes must ensure that communication strategies are well planned and conducted.

Consistent and effective collaboration is required between various departments to ensure a coordinated response to a crisis and to enable the institute to clearly communicate the situation status.

Info-Tech's Approach

Focus on implementing a structured and repeatable process that can be applied one department at a time to prevent BCP from becoming an overwhelming project.

Enable leaders to own the BCP going forward by establishing a template that the rest of the organization can follow.

Leverage BCP outcomes to refine IT DRP recovery objectives and achieve DRP-BCP alignment.

Info-Tech Insight

As an IT leader, you have the skill set and organizational knowledge to lead a BCP project, but you must enable leaders to own their department's BCP practices and outputs. They know their processes and, therefore, their requirements to resume business operations better than anyone else.

Use this research to create business unit BCPs and structure your overall BCP

A business continuity plan (BCP) consists of separate but related sub-plans, as illustrated below. This blueprint enables you to

  • Develop a BCP for a selected business unit (as a pilot project), and thereby establish a methodology that can be repeated for remaining business units.
  • Through the BCP process, clarify requirements for an IT disaster recovery plan (DRP). Refer to Info-Tech's disaster recovery planning workshop for instructions on how to create an IT DRP.
  • Implement ongoing business continuity management to govern BCP, DRP, and crisis management.

Overall Business Continuity Plan

IT Disaster Recovery Plan

A plan to restore IT application and infrastructure services following a disruption.

Info-Tech's Create a Right-Sized Disaster Recovery Plan blueprint provides a methodology for creating the IT DRP. Leverage this blueprint to validate and provide inputs for your IT DRP.

BCP for Each Business Unit

A set of plans to resume business processes for each business unit. This includes:

  • Identifying business processes and dependencies.
  • Defining an acceptable recovery timeline based on a business impact analysis.
  • Creating a step-by-step recovery workflow.

Crisis Management Plan

A plan to manage a wide range of crises, from health and safety incidents to business disruptions to reputational damage.

Info-Tech's Implement Crisis Management Best Practices blueprint provides a framework for planning a response to any crisis, from health and safety incidents to reputational damage.

IT leaders asked to develop a BCP should start with an IT disaster recovery plan

It's a business continuity plan. Why should you start continuity planning with IT?

  1. IT services are a critical dependency for most business processes. Creating an IT DRP helps you mitigate a key risk to continuity quicker than it takes to complete your overall BCP, and you can then focus on other dependencies such as people, facilities, and suppliers.
  2. A BCP requires workarounds for IT failures. But it's difficult to plan workarounds without a clear understanding of the potential IT downtime and data loss. Your DRP will answer those questions, and without a DRP, BCP discussions can get bogged down in IT discussions. Think of payroll as an example: if downtime might be 24 hours, the business might simply wait for recovery; if downtime might be a week, waiting it out is not an option.
  3. As an IT manager, you can develop an IT DRP primarily with resources within your control. That makes it an easier starting point and puts IT in a better position to shift responsibility for BCP to business leaders (where it should reside) since essentially the IT portion is done.

Create a Right-Sized Disaster Recovery Plan today.

Business continuity management in higher education requires proactive planning

Three components of crisis management postsecondary institutes should consider:

Emergency planning
This addresses the immediate response to the situation. It includes procedures and policies for effective response to chaotic situations such as natural disasters, security incidents, and student wellbeing and public health issues. The institution leads should ensure appropriate business continuity measurements, such as allocation of emergency response team, evacuation protocols, and communication plans, are in place.

Business continuity management
BCM involves procedures to ensure that the institute will maintain its integrity while leaders are handling the situation. BCM includes identification of the critical systems, resources, and processes that help the institute sustain its critical operations. By enabling BCM, you will enable strategies and processes to minimize the potential impacts of disruptions.

Academic integrity
The COVID-19 pandemic helped institutions realize the critical need for academic continuity planning, including the development of remote education platforms and contingency plans for exams, to provide seamless support for students and professors. Learning management platforms, content creation tools, collaboration solutions, and presentation platforms are a few examples of the tools necessary to enable academic institutes to run efficient business continuity.

Complexities within the higher education pose multiple challenges when driving an effective BCP

Technology dependency
Education institutes are highly dependent on technology to fulfill teaching, learning, research, and administration requirements. It is crucial to ensure the availability and integrity of security, infrastructure, networks, databases, and servers. The presence of so much technology makes the whole business vulnerable to chaos and disruptions.

It's beyond technology
While technology is crucial for effectively supporting students during a crisis, BCP strategies should also prepare for support mechanisms such as an efficient service desk for troubleshooting, online counseling services to address students' emotional needs, and online mentoring programs to assist students with an extra level of support, if the need arises.

Students' diverse technology skill set and engagement levels
One challenge with BCP in higher education is that some students are not proficient in eLearning, while others are proficient enough yet less engaged than they would be in person. This challenge places a great deal of burden on educators to engage students.

Financial restrictions
Financial restriction is a challenge most postsecondary institutes face. While this constraint often causes leadership to focus on other priorities, it is crucial to allocate resources to ensure a comprehensive BCP strategy.

Use-case uniqueness contributes to the complexity of implementing BCP in higher education

Universities require a tailored approach to BCP to tackle their distinct use cases

Diverse groups
Higher education institutes deal with diverse chaotic situations within departments and faculties, each with its own processes, dependencies, and technology. This diversity makes BCP fulfillment challenging.

Complexities within research sites
Crisis management in research sites such as laboratories is very challenging and requires unique safety protocols. For instance, researchers must be physically in the lab, and remote platforms aren't useful in most situations. When researchers work on highly classified data, ensuring personnel, data, and student safety becomes a high priority.

Complex interdependencies
Multiple facilities such as library resources, infrastructure technology, research technology, and administrative support are interconnected, making it difficult to separate these components.

Diverse engagement and communication requirements
Within postsecondary institutes, three groups of people should be engaged: Staff, professors, and students. Leaders should understand the requirements of each group, get their input, and ensure their buy-in to BCP protocols. The variety of use cases and impacted people makes BCP challenging.

Info-Tech Insight

In this blueprint, we keep referring to business units. In the higher education context, depending on the sector, this can mean the department, faculty, or research site.

Modernize the BCP

If your BCP relies heavily on paper-based processes as workarounds, it's time to update your plan.

“Hi, it's the 1980s. We'd like our BCP back…”

Back when transactions were recorded on paper and then keyed into the mainframe system later, it was easier to revert to deskside processes. There is very little in the way of paper-based processes anymore, and as a result, it is increasingly difficult to resume business processes without IT.

Think about your own organization. What IT system(s) are absolutely critical to business operations? While you might be able to continue doing business without IT, this requires regular preparation and training. It's likely a completely offline process and won't be a viable workaround for long even if staff know how to do the work. If your data center and core systems are down, technology-enabled workarounds (such as collaboration via mobile technologies or cloud-based solutions) could help you weather the outage, and may be more flexible and adaptable for day-to-day work.

The bottom line:
Technology is a critical dependency for business processes. Consider the role IT systems play as process dependencies and as workarounds as part of continuity planning.

Info-Tech's approach

The traditional approach to BCP takes too long and produces a plan that is difficult to use and maintain.

The Problem

You need to create a BCP but don't know where to start.

  • BCP is being demanded more and more to comply with regulations, mitigate business risk, meet customer demands, and obtain insurance.
  • IT leaders are often asked to lead BCP.

A pie chart that shows internal mandates and customer demands

The Complication

A traditional BCP process takes longer to show value.

  • Traditional consultants don't usually have an incentive to accelerate the process.
  • At the same time, self-directed projects with no defined process go months without producing useful deliverables.
  • The result is a dense manual that checks boxes but isn't maintainable or usable in a crisis.

The Info-Tech difference:

Use Info-Tech's methodology to right-size and streamline the process.

  • Reduce required effort. Keep the work manageable and maintain momentum by focusing on one business unit at a time; allow that unit to own their BCP.
  • Prioritize your effort. Evaluate the current state of your BCP to identify the steps that are most in need of attention.
  • Get valuable results faster. Functional deliverables and insights from the first business unit's BCP can be leveraged by the entire organization (e.g. communication, assessment, and BC site strategies).

Expedite BCP development

Info-Tech's Approach to BCP:

  • Start with one critical business unit to manage scope, establish a repeatable process, and generate deliverables that become a template for remaining business units.
  • Resolve critical gaps as you identify them, generating early value and risk mitigation.
  • Create concise, practical documentation to support recovery.

A diagram that shows embed training and awareness throughout the planning process

By comparison, a traditional BCP approach takes much longer to mitigate risk:

  • An extensive, up-front commitment of time and resources before defining incident response plans and mitigating risk.
  • A “big bang” approach that makes it difficult to predict the required resourcing and timelines for the project.

A diagram that shows traditional BCP approach to create and validate response plans

Project Overview: BCP

Phase 1: Identify BCP Maturity and Document Process Dependencies

1.1 Assess current BCP maturity
1.2 Establish the pilot BCP team
1.3 Identify business processes, dependencies, and alternatives

Tools and Templates
BCP Business Impact Analysis Tool
BCP Maturity Scorecard
Pilot Project Charter
Business Process Workflows Examples

Phase 2: Conduct a BIA to Determine Acceptable RTOs and RPOs

2.1 Define an objective impact scoring scale
2.2 Estimate the impact of downtime
2.3 Determine acceptable RTO/RPO targets

Tools and Templates
BCP Business Impact Analysis Tool

Phase 3: Document the Recovery Workflow and Projects to Close Gaps

3.1 Determine current recovery procedures
3.2 Identify and prioritize projects to close gaps
3.3 Evaluate BC site and command center options

Tools and Templates
BCP Business Impact Analysis Tool
Tabletop Planning Template
Recovery Workflow Examples
BCP Project Roadmap

Phase 4: Extend the Results of the Pilot BCP and Implement Governance

4.1 Consolidate BCP pilot insights to support an overall BCP project plan
4.2 Outline a business continuity management (BCM) program
4.3 Test and maintain your BCP

Tools and Templates
Results Presentation
BCP Summary
Business Continuity Teams and Roles

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

Photo of BCP Summary

Key deliverable: BCP Summary

Summarize your organization's continuity capabilities and objectives in a 15-page, easy-to-consume template.

This document consolidates data from the supporting documentation and tools to the right.

Download Info-Tech's BCP Summary template

Photo of BCP Business Impact Analysis Tool

BCP Business Impact Analysis Tool

Use this tool to conduct and document a business impact analysis.

Photo of BCP Recovery Workflow Example

BCP Recovery Workflow Example

Model your own recovery workflows on this example.

Photo of BCP Project Roadmap

BCP Project Roadmap

Use this tool to prioritize projects that can improve BCP capabilities and mitigate gaps and risks.

Photo of BCP Relocation Checklists

BCP Relocation Checklists

Plan for and manage a site relocation, whether to an alternate site or remote work.

Insight summary

Focus less on risk and more on recovery

Avoid focusing on risk and probability analysis to drive your continuity strategy. You never know what might disrupt your business, so develop a flexible plan to enable business resumption regardless of the event.

Small teams = good pilots

Choose a small team for your BCP pilot. Small teams are better at trialing new techniques and finding new ways to think about problems.

Calculate downtime impact

Develop and apply a scoring scale to develop a more-objective assessment of downtime impact for the organization. This will help you prioritize recovery.

It's not no, but rather not now…

You can't address all the organization's continuity challenges at once. Prioritize high-value, low-effort initiatives and create a long-term roadmap for the rest.

Show value now

Get to value quickly. Start with one business unit with continuity challenges, and a small, focused project team who can rapidly learn the methodology, identify continuity gaps, and define solutions that can also be leveraged by other departments right away.

Lightweight testing exercises

Outline recovery capabilities using lightweight, low risk tabletop planning exercises. Our research shows tabletop exercises increase confidence in recovery capabilities almost as much as live exercises, which carry much higher costs and risks.

Blueprint benefits

Demonstrate compliance with demands from regulators and customers

  • Develop a plan that satisfies auditors, customers, and insurance providers who demand proof of a continuity plan.
  • Demonstrate commitment to resilience by identifying gaps in current capabilities and projects to overcome those gaps.
  • Empower business users to develop their plans and perform regular maintenance to ensure plans don't go stale.
  • Establish a culture of business readiness and resilience.

Leverage your BCP to drive value (business benefits)

  • Enable flexible, mobile, and adaptable business operations that can overcome disruptions large and small. This includes making it easier to work remotely in response to pandemics or facility disruptions.
  • Clarify the risk of the status quo to business leaders so they can make informed decisions on where to invest in business continuity.
  • Demonstrate to customers your ability to overcome disruptions and continue to deliver your services.

Info-Tech Advisory Services lead to measurable value

Info-Tech members told us they save an average of $44,522 and 23 days by working with an Info-Tech analyst on BCP.*

Why do members report value from analyst engagement?

  1. Expert advice on your specific situation to overcome obstacles and speed bumps.
  2. Structure the project and stay on track.
  3. Review project deliverables and ensure the process is applied properly.

Info-Tech analyst services: almost as awesome as puppies and kittens.
* Based on client response data from Info-Tech's Measured Value Survey, following analyst advisory on BCP.

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit
"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

Guided Implementation
"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

Diagnostics and consistent frameworks are used throughout all four options.

Guided Implementation

Your trusted advisor is a call away.

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

A typical GI is 8 to 12 calls over the course of four to six months.

What does a typical GI on this topic look like?

A diagram that shows Guided Implementation in 10 calls.

Workshop overview

Day 1: Identify BCP Maturity, Key Processes, and Dependencies

1.1 Assess current BCP maturity.
1.2 Identify key business processes to include in scope.
1.3 Create a flowchart for key business processes to identify business processes, dependencies, and alternatives.

1. Baseline BCP maturity status
2. Business process flowcharts
3. Business process dependencies and alternatives recorded in the BIA tool

Day 2: Conduct a BIA to Determine Acceptable RTOs and RPOs

2.1 Define an objective scoring scale to indicate different levels of impact.
2.2 Estimate the impact of a business disruption on cost, goodwill, compliance, and health & safety.
2.3 Determine acceptable RTOs/RPOs for selected business processes based on business impact.

1. Potential impact of a business disruption quantified for selected business processes
2. Business processes criticality and recovery priority defined
3. Acceptable RTOs/RPOs defined based on business impact

Day 3: Document the Current Recovery Workflow and Projects to Close Gaps

3.1 Review tabletop planning – what is it, how is it done?
3.2 Walk through a business disruption scenario to determine your current recovery timeline, RTO/RPO gaps, and risks to your ability to resume business operations.
3.3 Identify and prioritize projects to close RTO/RPO gaps and mitigate recovery risks.

1. Current-state recovery workflow and timeline
2. RTO/RPO gaps identified
3. BCP project roadmap to close gaps

Day 4: Identify Remaining BCP Documentation and Next Steps

4.1 Assign business continuity management (BCM) roles to govern BCP development and maintenance, as well as roles required to execute recovery.
4.2 Identify remaining documentation required for the pilot business unit and how to leverage the results to repeat the methodology for remaining business units.
4.3 Workshop review and wrap-up.

1. BCM roles and responsibilities defined
2. Workshop results deck; use this to communicate pilot results and next steps

Day 5: Next Steps and Wrap-Up (offsite)

5.1 Finalize deliverables for the workshop.
5.2 Set up review time for workshop outputs and to discuss next steps.

1. Finalized deliverables

Contact your account representative for more information.

Phase 1

Identify BCP Maturity and Document Process Dependencies

A diagram that shows phase 1 to 4.

Insights & Outcomes
Define the scope for the BCP project: assess the current state of the plan, create a pilot project team and pilot project charter, and map the business processes that will be the focus of the pilot.

BCP Coordinator, BCP Executive Sponsor, Pilot Business Unit Manager & Process SMEs

Develop a Business Continuity Plan for Higher Education preview picture

About Info-Tech

Info-Tech Research Group is the world’s fastest-growing information technology research and advisory company, proudly serving over 30,000 IT professionals.

We produce unbiased and highly relevant research to help CIOs and IT leaders make strategic, timely, and well-informed decisions. We partner closely with IT teams to provide everything they need, from actionable tools to analyst guidance, ensuring they deliver measurable results for their organizations.

What Is a Blueprint?

A blueprint is designed to be a roadmap, containing a methodology and the tools and templates you need to solve your IT problems.

Each blueprint can be accompanied by a Guided Implementation that provides you access to our world-class analysts to help you get through the project.

Need Extra Help?
Speak With An Analyst

Get the help you need in this 5-phase advisory process. You'll receive 5 touchpoints with our researchers, all included in your membership.

Guided Implementation 1: Scoping
  • Call 1: Scope requirements, objectives, and stakeholders. Identify a pilot BCP project.

Guided Implementation 2: Business Processes and Dependencies
  • Call 1: Assess current BCP maturity. Create business process workflows, dependencies, alternates, and workarounds.

Guided Implementation 3: Conduct a BIA
  • Call 1: Create an impact scoring scale and conduct a BIA. Identify acceptable RTO and RPO.

Guided Implementation 4: Recovery Workflow
  • Call 1: Create a recovery workflow based on tabletop planning.

Guided Implementation 5: Documentation & BCP Framework
  • Call 1: Summarize the pilot results and plan next steps. Define roles and responsibilities. Make the case for a wider BCP program.


Frank Trovato

Andrew Sharp

Mahmoud Ramin


  • Dr. Bernard A. Jones, MBCI, CBCP, Berkeley College
  • Kris Roberson, Disaster Recovery Analyst, Veterans United Home Loans
  • Trevor Butler, General Manager of Information Technology, City of Lethbridge
  • Robert Miller, Information Services Director, Witt/Kieffer
Visit our Exponential IT Research Center
Over 100 analysts waiting to take your call right now: 1-519-432-3550 x2019