• prioritising the activities to be recovered by conducting a business impact analysis (BIA)
• performing a risk assessment (aka risk analysis) for each of the IT services to identify the assets, threats, vulnerabilities and countermeasures for each service.
• evaluating the options for recovery
• producing the contingency plan
• testing, reviewing, and revising the plan on a regular basis.