Assess your exposure
Start with the systems your business cannot operate without. Map them to people, locations, and dependencies. You cannot protect what you have not named.
- Inventory critical systems, applications, and data stores
- Identify single points of failure (one person, one site, one vendor)
- Document RTO (recovery time) and RPO (data loss tolerance) for each system
- Confirm geographic redundancy on hosting and backups
