Understanding what’s important – spoiler alert: it’s the processes, not the technology 

Understanding your risk appetite – what can you tolerate, what will destroy your business 

Planning to recover – if you don’t test your ability to recover, you don’t know if you can rely on it