Business impact analysis — identify critical functions and recovery priorities

Risk assessment and threat matrix — natural disasters, cyber, supply chain

Emergency response team — roles, contact tree, and escalation paths

IT disaster recovery plan — data backup, cloud redundancy, and failover

Remote work enablement plan — VPN, hardware, and communication tools

Crisis communication plan — internal and external notification procedures