Recovery you've actually rehearsed: RTO/RPO set by the business, architectures that meet them at known cost, and game-days that prove the plan before reality does.
- Business-impact analysis → tiered RTO/RPO targets
- DR architecture: backup, pilot-light, warm standby, or active-active
- Immutable backups and ransomware-recovery paths
- Scheduled game-days with findings fed back into the design