There are usually three parts to a disaster recovery policy: before the disaster: risk analysis, preventative measures and staff training, during the disaster: staff response – implement contingency plans, after the disaster: recovery measures, purchasing replacement hardware, reinstalling software, restoring data from backups