Free Template for Dealers

Business Continuity Plan Template for Dealerships

A fill-in plan for keeping sales, F&I, service and parts open when the DMS, the internet, the phones or the power go out.

Request a Complimentary Assessment →

Or download the template as an editable Word file or a printable PDF.

Dealership service advisor writing a paper repair order by hand at the service write-up counter, with a sedan in the open service bay behind him

A business continuity plan template for dealerships is a fill-in plan for keeping the store selling and servicing through an outage, from a down DMS or internet line to a storm, with named owners and recovery targets you set.

Last updated: November 5, 2026

DMS or internet down

Power out or a storm

A store can’t open

One plan

An outage doesn’t care why it happened. Your plan shouldn’t either.

Picture a Tuesday at ten in the morning. A backhoe down the road cuts the fiber line, and the DMS, the phones and the card machines that run over it all stop at once. Nobody did anything wrong. But the sales desk, the service drive and the parts counter each want an answer right now, and it’s the same answer every time: who decides, what still works, and who calls whom?

That’s what this template is for. It isn’t only for cyberattacks. It covers the ordinary outages too, like a dead firewall, a storm or a vendor having a bad day, and it goes department by department. You set the recovery targets, not a vendor. Fill it in with your general manager, your controller and whoever runs IT, and test it once a year. A good managed IT team for dealerships keeps the lines, firewalls and backups behind it honest.

One rule before you start. The targets in section 3 are yours to set, so write them down before anyone needs them.

The template

The Dealership Business Continuity Plan Template

Download it as an editable Word file or a printable PDF. Same nine sections, same numbers. The plan you fill in matches this page line for line.

IT technician plugging a network cable into one of two network appliances in an open wall-mounted cabinet at a dealership

Where Helion fits

We run managed IT and cybersecurity as one team, so the IT line in section 2 can point to one provider instead of several. A complimentary IT and cybersecurity assessment reviews what’s already in place and puts the findings in writing.

Business continuity plan: section by section Each numbered item is a blank on the template. Fill in one copy per store, or one for the group with every rooftop listed.

1 The plan and who owns it

1.1 The stores and buildings this plan covers, with each address.
1.2 The plan owner, and a backup owner who can act when the owner is away.
1.3 Who can declare an outage and move a store to its fallback, without waiting for anyone else.
1.4 Where the printed copies are kept, including one copy away from the building.

Print it. A plan saved only on the file server may not open during the very outage it was written for.

2 The contact tree

2.1 Each department manager’s cell number, and the one person each of them calls first.
2.2 Your IT provider, DMS provider, internet carrier and phone provider, each with its account or circuit number.
2.3 Your lenders, your manufacturer’s dealer support line, your insurer and your bank.
2.4 How you’ll reach staff and customers if email and the desk phones are both down.

If the outage could be a cyberattack, the incident response plan template takes over the security calls, such as the insurer, breach counsel and the incident log. This plan is for keeping the store working while that happens.

3 Recovery priorities and targets

IT people call these the recovery time objective and the recovery point objective. We just ask two things about every system. How long can the store wait for it? How much work could you stand to redo? Those answers decide what gets fixed first. They also tell you what’s worth paying to protect, and what isn’t.

3.1 The order your systems come back in, written as a ranked list.
3.2 For each system, the longest the store can run on its fallback before it costs real business.
3.3 For each system, how many hours of entries you could afford to lose or key in again.
3.4 Who signed off on these targets, and the date.

These numbers are the dealership’s call. An IT provider can tell you what a target takes and test against it, but it can’t pick the target for you.

4 Internet, firewall and power

Erik Nachbahr, our founder, starts with the line into the building: “Have multiple internet providers, evaluating having something that’s not wired, so Starlink… consider satellite as a second connection.” On the firewall, he’s direct: “Most of the time, we find dealers don’t have a second firewall. So if that hardware goes down, your lifeline is completely down.”

4.1 Your main internet carrier at each store, with the circuit ID and the support number.
4.2 A second connection from a different company over a different path, including a non-wired option such as satellite or cellular.
4.3 A second firewall, or a spare on the shelf, and the person who swaps it in.
4.4 Which systems the second connection carries: the DMS, phones, card terminals and manufacturer tools.
4.5 Battery backup for the network closet, how long it lasts, and whether a generator covers the building.

5 Data, backups and retention

Here’s the trap with the cloud. People stop thinking about the copy. As Erik puts it, “Just because your data is in the cloud doesn’t mean it’s backed up. You have to have cloud-to-cloud backup.” That goes for the older systems still sitting on a server in the building too.

5.1 Every place store data lives: on-site servers, the DMS, Microsoft 365 and other cloud apps.
5.2 How each one is backed up, including cloud-to-cloud backup for Microsoft 365 and your other cloud systems.
5.3 Older systems still on a server in the building, and the plan to move them to the cloud and back them up there.
5.4 How long each vendor keeps your data, and how it’s disposed of when you leave.
5.5 The date of the last test restore, and how long it took.

Microsoft 365 Backup is a separate pay-as-you-go offering for SharePoint, OneDrive and Exchange, and Microsoft says retention and deletion policies don’t affect its recovery window. Our backup and disaster recovery page shows who keeps which copy.

6 Department fallbacks

6.1 Sales: who can approve a deal on paper, and where the paper deal packs are kept.
6.2 F&I: which lender portals still work without the DMS, and the paper contracts on hand.
6.3 Service: paper repair orders, tomorrow’s appointment list and how technician hours get recorded.
6.4 Parts: a recent price and bin list, numbered counter tickets and who can still order from the manufacturer.
6.5 Accounting and the office: how payroll runs, and how the paper gets entered once systems are back.

7 Phones and customers

7.1 Where the main number and each department line forward when the desk phones are down.
7.2 A short script for staff: what customers hear, and when someone will call them back.
7.3 Who updates the website, the Google listing and social pages if a store closes for the day.

8 If a store can’t open

8.1 Where each department works if a building can’t open, such as a sister store or a temporary space.
8.2 How quickly you want to stand up another location or restore its data, written as your own target.
8.3 What moves with the staff: laptops, deal jackets, forms and parts already promised to customers.

Section 8 leans on section 5. A store can only work from somewhere else if its data can be reached from somewhere else.

9 The yearly test

9.1 The date of this year’s test, and who runs it.
9.2 The outage you’ll walk through, picked from the table below.
9.3 What didn’t work, who’s fixing it, and by when.

A walk-through around a table with the department managers counts as a test. So does switching one store to its second internet line on a quiet afternoon.

Section 9.2

One Business Continuity Plan, Seven Kinds of Outage

Use this table two ways. When something breaks, find the row and turn to the sections in the last column. Once a year, pick a row and walk it through with your managers.

What goes down	What the plan has ready	Where it is in the template
The DMS	The person in 1.3 moves the store to paper, and each department opens the fallback it wrote down in advance.	Sections 1, 3 and 6
The internet line	The second connection picks up the DMS, the phones and the card terminals, as long as it was set up to carry them.	Section 4, items 4.2 and 4.4
The firewall	A second firewall or a spare on the shelf, and a named person who knows how to swap it in.	Section 4, item 4.3
Power, or a storm	Battery backup buys time in the network closet. Paper and the contact tree carry the rest of the day.	Sections 2, 4 and 6
The phones	Lines forward to the numbers in 7.1, and everyone answering uses the same short script.	Section 7
A key vendor	The support line and account number are already printed, and the departments know their fallback.	Sections 2 and 6
A whole store	Staff move to the place named in 8.1, and the data they need can be reached from there.	Sections 5 and 8

A cyberattack can cause any row in this table. When it does, run the incident response plan alongside this one.

What the June 2024 CDK Outage Showed About Continuity

On June 19, 2024, CDK Global notified its dealership customers that it had suspended certain systems in response to a cybersecurity incident. Two publicly traded dealer groups described the impact in SEC filings, and the filings read a lot alike. One group’s 8-K filing said all of its dealerships were “open and operating utilizing workaround solutions.” Another’s said all of its U.S. dealerships “continue to conduct business using alternative processes.”

Workarounds like that depend on somebody knowing which deals can close on paper, which repair orders can be written by hand and who is allowed to say so, and that’s a continuity plan whether or not anyone calls it one. The next outage at your store may have nothing to do with a DMS vendor at all, and the same plan answers it.

The workaround is the plan.

June 19, 2024

One group’s filing said the outage disrupted the DMS hosted by CDK, which supports its sales, inventory and accounting work, and its customer relationship management system as well.

The outage started at the vendor, not the store.

Stores kept doing business

Both filings described stores that kept doing business on workarounds and alternative processes while CDK’s systems were out.

Section 6 is where yours get written down.

Who’s Behind This Business Continuity Plan Template

2,000+ Automotive and heavy truck dealerships

35,000+ Dealership employees supported daily

98% Client retention rate

1997 Working only with dealerships since

Helion Technologies has worked only with automotive and heavy truck dealerships since 1997. Managed IT and managed cybersecurity run as one team here, so the internet lines, firewalls and backups in a continuity plan can sit with one owner instead of several.

How to Fill In and Test Your Business Continuity Plan

1
Name the owner and the deciders
Start with section 1. Nothing else works until someone is allowed to move the store to paper.
2
Set the targets with your managers
Rank the systems together, then agree how long each department can run without them.
3
Ask IT for sections 4 and 5
The lines, firewalls and backups are facts your IT provider should be able to give you in writing.
4
Print it, then test it yearly
Keep copies off the network, and walk one outage from the table through with your managers each year.

Common Questions

Two dealership managers at a conference table walking through a printed business continuity plan, with an open binder beside the pages

Finished the plan?

Bring it to a complimentary IT and cybersecurity assessment and we’ll review your current setup and put the findings in writing. Prefer a figure first? Get a price quote.

What should a dealership business continuity plan include?

An owner, a contact tree, the order your systems come back in, a fallback for each department, a second internet line and firewall, tested backups and a yearly test. That’s the nine sections above. The printable version runs five pages.

How is it different from an incident response plan?

The incident response plan is for a security incident: containing it, sizing it up, calling the insurer. This plan is for keeping the store selling and servicing through an outage, cyber or not. In an attack you run both.

What do RTO and RPO mean in plain words?

RTO is how long a system can be down before it really hurts, and RPO is how much entered work you could stand to lose. You set both, system by system. IT calls them the recovery time objective and the recovery point objective. Section 3 asks for both.

Does a dealership really need a second internet connection?

If the DMS, the phones and the card terminals all run over one line, one cut cable stops all three. The fix is a second line from another company, coming in a different way. Add a second firewall too, because if both lines run through one firewall, one dead box takes both down with it.

Isn’t our data safe because it’s in the cloud?

Not on its own. Data sitting in Microsoft 365 or another cloud app isn’t the same as a backup you control and have restored at least once. That’s why section 5 asks for cloud-to-cloud backup and the date of the last test restore.

How often should we test the plan?

Once a year, and again after a big change such as a new store, a new internet carrier or a new DMS. A walk-through around a table with the department managers counts. Write what didn’t work in 9.3, along with who’s fixing it.

Can Helion help us fill it in?

Yes. Bring sections 4 and 5 to the complimentary assessment. We look at what you run today, check whether tools like your firewall are actually set up right, and write down what we find. The targets in section 3 stay yours to set.

Bring the plan in, even half done, to a complimentary assessment. We’ll review the technology behind it and put what we find in writing.

Get Your Complimentary IT & Cybersecurity Assessment →