Montreal Small Business Continuity Plan Template

Executive Summary

A Montreal small business continuity plan can fit on one page if it answers five operating questions: which client promise must continue, how long each activity may pause, who decides, which safe workaround starts first, and when the team moves. This report supplies a copyable plan, a spreadsheet schema, and activation rules for power loss, internet loss, and inaccessible premises. The approach adapts the Business Development Bank of Canada's essential-service prioritization and trigger guidance, plus Public Safety Canada's business impact analysis method. ^{[1] [2] [3]}

The central decision is a recovery time target set below each process's maximum tolerable downtime. These are business choices, not published Montreal outage averages. In the illustrative plan, a client response might tolerate four hours while a same-day deliverable tolerates one hour; the team would begin a backup connection or relocation early enough to restore the work before that limit. The Financial Consumer Agency of Canada distinguishes a maximum allowable downtime from a recovery time objective in its own planning terminology. ^{[4] [5]} An official Canadian internet-resilience guide illustrates a smartphone hotspot and a manual reconnection period of under 30 minutes for a small-business scenario, but that figure is an example, not a universal target. ^{[6] [7]}

For a power interruption, check the Hydro-Québec outage tracker and report an unlisted outage at 1 800 790-2424. ^{[8] [9]} For immediate danger, use 911; Montréal's 311 handles municipal service matters, with 514 872-0311 listed for callers outside Montréal. ^{[10] [11]} Leave a building when authorities direct it or safety is in doubt, respect cordons, and wait for authorization before returning. ^{[12] [13] [14]}

A backup workspace is useful only if people can get there safely, access it when needed, use enough seats and private call space, authenticate to required data, and verify power and connectivity on that day. The Canadian Chamber of Commerce includes an alternate location in its continuity planning guide, while the Canadian Centre for Cyber Security recommends multifactor authentication and secure remote access practices. ^{[15] [16] [17]} 2727 Coworking lists hot desks from $300 per month and private offices in Montréal; its published pages do not establish an outage response guarantee, so any business considering it should confirm actual availability and service conditions directly. ^{[18] [19]} The template should be reviewed quarterly and exercised with a tabletop discussion and a timed recovery attempt. BDC explicitly recommends trial runs. ^[20]

Introduction and Background

An outage does not have to destroy records to stop a small firm from keeping a client commitment. A powerless office may leave laptops charged but the router down. A working building may still lack internet. A third situation may keep both systems functioning while staff cannot enter the premises. Each calls for a different response. The Canadian Radio-television and Telecommunications Commission identifies technical failures and weather among causes of telecom service interruptions, but no single occurrence rate or cost describes every Montréal microbusiness. ^[21]

The practical unit of planning is an essential service, such as responding to urgent client requests, issuing a time-sensitive file, taking a booking, or processing an order. BDC asks organizations to classify services by criticality. ^[1] A business impact analysis, or BIA, connects each service to the effect of interruption; the National Institute of Standards and Technology defines it as analyzing operations and the effect of disruption. ^[22] Here, the BIA is deliberately short. The owner records the promise, dependency, tolerable interruption, workaround, and person who can activate it.

This guide is scoped to a founder, freelancer, office manager, or hybrid team of roughly one to twenty people as a planning example, not as a threshold in any authority's guidance. It addresses the first hours or days of an interruption and the decision to continue, pause, switch connection, work asynchronously, or move. A security incident needs its own incident response procedure. Public Safety Canada describes emergency management and business continuity as complementary planning activities. ^[23] The one-page format below keeps employee safety and client delivery visible together without implying that a plan meets an insurance condition or formal standard.

The source base is intentionally practical. BDC's eight-step guide covers critical operations, action teams, contacts, procedures, triggers and testing. ^[24] The Canadian Chamber of Commerce's continuity guide, hosted under a July 2020 file path but undated within the document, asks businesses to identify operations critical to survival and consider a temporary site. ^{[25] [15]} Québec, Montréal, Hydro-Québec, federal telecom guidance and cyber guidance supply the local and technical parts. This report's thresholds and calculations are illustrative inputs for the reader to replace, not measured outage benchmarks.

What a Minimum Viable Continuity Plan Contains

Start with a client promise and a downtime limit

Write one sentence for each essential process: “Who expects what, by when?” A small design firm might need to deliver a signed file before a contractual review, while routine internal filing can wait. The table should say which process can stop, how long it can stop, and what loss follows. Public Safety Canada advises quantifying interruption impact where possible. ^[3] The Financial Consumer Agency of Canada's public plan defines maximum allowable downtime as the longest acceptable service interruption and a recovery time objective, or RTO, as the period within which the service or resource must be restored. ^{[4] [5]} For a microbusiness, call these “latest tolerable restart” and “target restart.” Put the target earlier than the limit to allow travel, authentication, and rework.

Do not write “all work is critical.” Rank the few activities that protect clients, staff and cash flow. BDC's framework uses Priority A, B and C for essential-service criticality. ^[1] A plan can use plain words instead: must continue today, can pause until tomorrow, and can be deferred. The classification must be made for a particular client promise and workload, then revisited when that workload changes.

Record the dependency chain

For each process, trace the route from person to output: employee, device, power, authentication, file or application, connection, supplier, and a private or physical place to work. A “backup” that depends on the same unavailable building or network may not be independent. The Cybersecurity and Infrastructure Security Agency asks planners to identify what other services a backup system depends on. ^[26] List the failure point rather than a vague risk label. “Cannot reach cloud files because office internet is down” gives an owner an action; “technology problem” does not.

For each dependency, record a manual workaround that is actually permitted. A paper intake form or delayed batch entry can keep a low-risk administrative process moving for a short period; NIST explicitly recognizes alternate or manual processing in contingency planning. ^[27] Do not copy client data onto an unapproved personal device just because it is available. If records cannot be handled safely offline, the process pauses and the client receives a revised time.

A fast dependency interview can use these six prompts:

• Person: Who can perform the work, and who covers an absence?
• Device: Which approved device and charger are needed?
• Data: Which file or application must be reachable, and how is access authorized?
• Connection: Which primary and tested backup paths can run that application?
• Place: Does the task need a secure room, physical material or accessible seating?
• Supplier: Which outside service or input must still function?

Set activation authority before the disruption

Name a primary decision maker and an alternate. BDC recommends an emergency manager with authority to act and calls for identified owners of action-plan steps. ^[28] The owner of a one-person firm is still a role: that person needs a written rule for when to tell clients, call a supplier, and stop attempting a repair. In a larger small team, a second person should be able to send the status message and book a safe site when the primary is unreachable. One authority, one alternate, and one timestamp for the next update prevent parallel decisions.

Power, Internet and Premises Triggers

The matrix below is a planning example. Its times are deliberately user-set thresholds, not predictions of utility restoration. The team should fill the blanks from its own RTOs, travel time and service promises. BDC recommends defining the conditions that activate a continuity plan. ^[2]

Table 1 turns three common workplace disruptions into observable triggers and actions.

The critical distinction is between time to decide and time to recover. If a deadline is at 15:00 and moving plus setup takes 90 minutes, a 14:30 relocation decision is too late. Put decision times in the plan. The team's own measured travel and login test, not a generic estimate, should set them. Where no safe route or suitable site exists, pausing and informing clients is the defined response.

At activation, the incident lead should make six short entries in the log:

• Start: Record when the affected process actually stopped.
• Scope: Name the process and whether power, internet or premises access is affected.
• Safety: Record staff status and any official instructions before assigning work.
• Limit: Read the process's latest tolerable restart and earlier recovery target.
• Mode: Choose continue, pause, connection switch, asynchronous work or relocation.
• Review: Name the next decision time and person who will send an update.

The power-only sequence

First account for people, lighting and exit routes. Montréal's fire service guidance says business emergency exits must remain safe and unobstructed and addresses emergency lighting during power loss. ^{[31] [32]} Next check whether the interruption affects only the premises or the surrounding area. Hydro-Québec's outage tools provide status information, and the utility says to report an outage by telephone at 1 800 790-2424. ^{[8] [9]} A battery-powered radio or mobile device is an official option for updates during a larger interruption. ^[33] Do not treat an estimated restoration time as a promise when setting client expectations.

The internet-only sequence

Separate application failure from connectivity failure by testing a known site and the needed business application through the backup connection. Federal guidance describes a smartphone hotspot and employee practice for this use case; it also advises choosing a mobile provider different from the primary internet provider where possible. ^{[6] [34]} Record the actual result, including whether multifactor authentication worked. If the office uses Voice over Internet Protocol, or VoIP, the CRTC warns calls may be unavailable during power or internet interruption; maintain a working alternative for urgent calls. ^[35]

The inaccessible-premises sequence

Treat access as a safety decision, not a productivity dispute. Québec's guidance says to evacuate when directed or when safety is at risk, respect safety perimeters, and wait for authorization before returning. ^{[12] [13] [14]} The continuity plan therefore assumes that essential devices, credentials and contact records can be accessed away from the office. If the only usable laptop or paper file remains inside, record that as a dependency gap during the next exercise.

People, Communications and Supplier Decisions

A call tree for one to twenty people

Use a single owner for each message and a named alternate. The incident lead declares the mode and next review time. The people lead checks staff safety, availability and the safest way to work. The client lead identifies deadlines and sends a status message. The technology lead tests access and backup connectivity. The premises lead speaks with the landlord or workspace provider and confirms any alternate booking. In a one-person operation, one person may hold all roles, but the checklist still prevents a missed audience. BDC's checklist explicitly names staff, customers and suppliers. ^[36]

Keep the contact list available if the normal system fails. Innovation, Science and Economic Development Canada recommends retaining contacts for colleagues, key clients and service providers and a printed emergency plan, contact lists and maps. ^{[37] [38]} Protect the printed copy and restrict it to what is necessary. The federal guidance also recommends exercising the communications plan. ^[39] A two-channel plan might start with a team message and fall back to text or phone. Text and email can use less bandwidth than calls during a congested event, according to federal guidance. ^[40]

The contact sheet should make the communication order obvious:

• Staff: Ask about safety and availability before asking about output.
• Emergency services: Use the appropriate official channel when immediate help is needed.
• Landlord or operator: Ask for safe access and the next confirmed status update.
• Connection provider: Check or report the service fault through its current channel.
• Client: State the effect on a specific promise and the next update time.
• Supplier: Confirm whether a critical input can be delivered another way.

Three short message templates

• Staff: “At [time], [site/process] is affected. Your safety comes first. Do not enter [area] until the authorized all-clear. Work mode is [pause/approved remote site/alternate location]. Reply with safe/need help and your availability by [time]. Next update: [time].”
• Client: “At [time], an interruption is affecting [service]. Your [deliverable/appointment] is [on schedule/revised to time/awaiting confirmation]. We will update you by [time] through [channel]. Contact [named person] for urgent changes.” Ready.gov notes that customers need to know how an emergency affects them. ^[41]
• Supplier or landlord: “We are assessing an interruption affecting [service/site]. Please confirm [status, restoration estimate if available, safe access conditions, alternate fulfilment, or next update] by [time]. Our contact is [name, mobile].”

Do not announce a restoration time that nobody controls. Say when the next update will occur and what remains unknown. If a supplier is essential to delivery, identify a second path for that input before a disruption. CISA discusses multiple suppliers as one resilience measure. ^[42] Confirm whether the substitute can legally and practically perform the same work; a name in a spreadsheet alone is not a tested workaround.

Data, Devices and an Alternate Workspace

A relocation plan starts before anyone travels. Each essential process should have an approved device, a way to authenticate, access to the current version of the file, a working phone path, and the authority to use the new site. The Canadian Centre for Cyber Security recommends corporately owned devices where possible for remote work, multifactor authentication, and a virtual private network where appropriate. ^{[43] [16] [17]} Its small-organization guidance asks whether backups and recovery have actually been tested. ^[44] This article does not replace a cyber incident plan. Never instruct staff to use an untrusted public wireless network for confidential client work.

Assess an alternate site as a specific location at a specific time. Confirm access hours, booking, arrival procedure, available seats, accessibility, call privacy, power, the actual connection staff may use, and whether the service depends on the same affected area. The Canadian Chamber guide includes temporary-location planning. ^[15] NIST's contingency guidance includes travel time, work space, security, equipment and telecommunications among site considerations. ^[45] Check whether the site shares an affected dependency. ^[26] A real booking or written arrangement is stronger than an unverified list of venues. For accessible transit planning, Montréal's transit agency supplies route planning and elevator status information. (Source: www.stm.info) (Source: www.stm.info)

Before treating a venue as a recovery site, obtain six answers:

• Access: What hours, booking confirmation and entry method apply on the relevant day?
• Capacity: How many people can work there at once, with their needed equipment?
• Privacy: Where can confidential calls and documents be handled appropriately?
• Connection: Which network is available, and can the approved business systems use it?
• Continuity: What does the operator say about current power and connectivity status?
• Travel: Can each assigned worker reach and use the site safely and accessibly?

Table 2 is a short-workspace decision sheet. “Verify” means ask the operator and test the arrangement before listing the site as a usable recovery location.

The price in the 2727 row is a published monthly hot-desk price, not a quoted emergency day rate or a claim that seats are guaranteed during an outage. Its virtual tour describes desks, private offices and conference rooms; that is a description of facilities, not proof of independent power or network resiliency. ^{[46] [19]} Apply the same verification standard to every provider. The plan should name a primary alternate and a second safe choice only if both were checked.

A Copyable One-Page Plan and Spreadsheet

The block below is designed to be copied into a document and exported as a one-page PDF. Replace every bracketed value. Keep the printed or offline copy secure. The spreadsheet columns immediately below provide the more detailed working record. The fields follow the official emphasis on essential operations, responsible people, contacts, alternate locations, triggers and exercises. ^{[24] [15] [38]}

One-page plan, version 2026-09-25

• Business and version: [legal name], [version date], review owner [name].
• People first: Emergency danger: 911. Do not enter an unsafe or restricted building. Account for staff through [channel] by [time].
• Decision authority: Primary [name/mobile]; alternate [name/mobile]. Next status decision [time].
• Minimum viable service: [client promise], due [time]. Process owner [name]; alternate [name].
• Limits: Maximum tolerable downtime [hours]; recovery target [time]; activation threshold [observable condition/time].
• Dependencies: [people, power, ISP, device, data, supplier, premises]. Approved workaround [specific action].
• Work mode: Continue [conditions]; switch connection [conditions]; work asynchronously [tasks]; pause [condition]; relocate to [verified site] by [decision time].
• Alternate site: [address/contact/booking reference], seats [number], privacy [yes/no], accessibility [verified], hours [verified], power and internet [tested date].
• Messages: Staff owner [name]; client owner [name]; supplier/landlord owner [name]. Next update [time].
• Recovery and return: Verify service and data, reconcile manual work, notify stakeholders, return only after safe authorization. Last exercise [date]; gaps and owners [list].

For the spreadsheet, use one row per process rather than one row per hazard. Paste this comma-separated header into a spreadsheet, then create one row for each essential process in your business. Keep client names or sensitive identifiers out of an unsecured shared copy. BDC recommends responsible people and backups in action plans. ^[28]

process,owner,alternate,dependency,maximum_tolerable_downtime,recovery_time_target,manual_workaround,data_device_needed,alternate_location,activation_threshold,contact,last_test

Test the plan twice

The first test is a tabletop: at a scheduled meeting, announce that the office loses power, the primary internet fails, or the building becomes inaccessible. Ask the lead to choose a mode, the client lead to draft a message, and the alternate to find the recovery site and contacts. Record missing information and assign an owner. Public Safety Canada recommends recording what occurs in exercises, while BDC recommends trial runs. ^{[47] [20]}

The second test is a timed recovery exercise with no risky production change. Start a clock, have an authorized person use the backup connection or site, authenticate to a test or approved low-risk system, retrieve the right file, and send a test status message. Stop when the essential process is genuinely usable, not when travel ends. Record time, failed steps and corrective actions. Quarterly contact and dependency review is the schedule proposed in this template, not an externally mandated interval.

Use the same scorecard for both exercises:

• Decision time: How long before the lead chose the operating mode?
• Contact reach: Did the alternate and every relevant audience receive a message?
• Login: Could an authorized worker use the needed application from the fallback?
• Output: Could the team complete a representative low-risk work item?
• Elapsed time: Was the process usable before its recovery target?
• Correction: Which gap has an owner and a due date?

Data Analysis and Evidence

The most useful quantitative model here is business-specific exposure, not an invented citywide outage statistic. Public Safety Canada says a BIA should quantify loss impact where possible, and the Financial Consumer Agency of Canada distinguishes maximum allowable downtime from the recovery target. ^{[3] [4] [5]} For each response option, estimate the hours from interruption until the affected process can resume under that option, including decision, travel, setup and login time where applicable. Estimate the hours separately for waiting, switching connection and relocating; stop counting downtime when the workaround restores the process, even if the underlying outage continues. Then calculate option-specific planning impact = hourly gross margin at risk × that option’s expected interruption hours + that option’s recovery costs. Compare the option totals using the same process and hourly margin. This is a planning estimate, not insured loss, accounting profit, a probability-weighted forecast, or a Montréal benchmark.

Table 3 uses transparent hypothetical inputs to show one response option for each disruption. Each downtime value runs from interruption until the process resumes under the stated option, not until the underlying outage ends. It does not assign an outage probability. Replace the values with the business's own observed margins, option-specific downtime estimates and tested recovery costs.

The arithmetic exposes a limit: the same “outage” costs different businesses different amounts because the process, deadline, margin and available workaround differ. The 2023 federal internet-resilience guide's under-30-minute manual reconnection example is helpful as a design illustration, but it does not measure the downtime of Canadian businesses. ^[7] A business should use its own timed exercise to estimate reconnection and travel time. It should also check whether a hotspot and primary internet share a dependency, as CISA's backup-dependency question suggests. ^[26]

The scenario table intentionally excludes speculative outage frequency. Without an originator's applicable local dataset and a matching business exposure model, multiplying a generalized frequency by these values would imply precision that the evidence does not support. The more actionable measure is the gap between the latest tolerable restart and the tested recovery time. If that gap is negative, change the workaround, move the activation threshold earlier, or renegotiate the client promise before relying on the plan.

Implications and Future Directions

A microbusiness continuity plan should change when its operating dependencies change. A new cloud application, supplier, office arrangement, mobility need or client service window can invalidate a previously successful test. BDC recommends regular updating, and the Canadian Centre for Cyber Security explicitly asks whether backup and recovery processes have been tested. ^{[20] [44]} Review contacts and dependencies quarterly, and repeat the timed exercise after a material change. This cadence is a practical template choice; the sources do not impose a universal quarterly rule.

Montreal-specific monitoring belongs in the plan as a route to current information, not a static prediction. Québec recommends registering for municipal alerts; Montréal offers email or text notices and lets subscribers record up to five addresses, which can include a workplace. ^{[48] [49] [50]} The Hydro-Québec tracker and the actual internet provider's status channel should be checked during an event. ^{[8] [30]} If an official alert gives safety instructions, follow those instructions before applying a business recovery rule.

The alternate-workspace market can be useful to a small team, but the plan should treat every site as a bundle of dependencies. A workspace address does not by itself establish available seats, uninterrupted electricity, an independent network, privacy for calls or safe travel. The Canadian Chamber asks planners to assess a temporary location, while CISA calls attention to dependencies behind backups. ^{[15] [26]} The next revision of a small firm's plan should therefore contain a tested booking path, a day-of verification call, an approved connection method, and a named person who may decide to pause instead. That is a more meaningful reserve capability than a list of addresses.

Frequently Asked Questions (FAQs)

What should a Montreal business continuity checklist include?

It should name essential processes and their owners, maximum tolerable downtime, recovery targets, dependencies, manual workarounds, activation triggers, staff and client contacts, a safe alternate location, and the last test result. BDC's planning steps and the Canadian Chamber guide support these elements. ^{[24] [25]} The one-page plan above is a starting document; the spreadsheet carries process-level detail.

Is a power outage plan different from an internet outage plan?

Yes, because power loss may affect lighting, building safety, chargers and network equipment, while a standalone internet loss may leave the premises usable. Hydro-Québec provides outage status and reporting, and federal resilience guidance gives a mobile hotspot as one possible connectivity fallback. ^{[8] [6]} In both cases, the business applies its own recovery target and confirms the workaround actually supports the required application.

When should a small team relocate?

Relocate when the primary site cannot safely support an essential process, the verified alternate site can restore that process before its target, and people can travel safely. If the building is restricted, respect the perimeter and await authorization to return. ^{[13] [14]} Relocation is unnecessary if approved remote work or an asynchronous workaround meets the promise, and inappropriate when no safe, suitable site is available.

What number should staff call in Montreal?

For immediate danger, Montréal directs callers to 911. The city lists 311 for municipal service issues and 514 872-0311 from outside Montréal. ^{[10] [11]} Hydro-Québec lists 1 800 790-2424 for reporting an outage. ^[9] The plan should also contain the actual landlord, internet provider, client and alternate-workspace contacts. Review this contact block as of 2026-09-25 before using the template later.

Conclusion

The workable small business continuity plan template for Montréal is a decision record, not a generic inventory of hazards. It starts with an essential client promise and a maximum interruption. It assigns a recovery target earlier than that limit, identifies the exact dependency that can stop the work, and tells one person when to continue, pause, switch connection, work asynchronously or activate a safe alternate site. The source frameworks emphasize critical operations, activation triggers, responsible people, contacts, alternate location planning and testing. ^{[24] [2] [15]}

The plan should be usable when the normal office systems are unavailable. Keep an accessible approved copy of the contacts and decisions; practice the fallback connection and site; test authentication and data access; and send clients a specific next-update time. Treat the illustrative monetary formula as a way to compare options using the business's own inputs. It cannot predict an outage or justify entering a restricted building. The three scenario rows show how to evaluate power, internet and premises disruption without inventing a frequency.

The strongest version is short enough for a founder to use under pressure and specific enough for another team member to execute. Fill the bracketed fields, verify any alternate workspace directly, run both exercises, log defects and owners, and review the plan each quarter. If the next test shows that recovery takes longer than the stated target, revise the trigger or the client promise before the next interruption. ^{[20] [47]}