Risk is the possibility of loss, and may come in the form of natural disasters, internal theft, viruses, or any number of other potential threats. To address this possibility, risk management is used to identify potential threats and develop methods of dealing with them before they result. Risk management requires a company to identify what risks may affect them, the assets related to certain risks, the likelihood and impact of each occurring, and methods to reduce the damage that may be caused if they occur.

Disaster recovery plans provide procedures for recovering after a disaster occurs, and provide insight into methods for preparing for the recovery should the need arise. Disasters can also occur in the form of employees' accidentally or maliciously deleting data, intrusions of the system by hackers, viruses and malicious programs that damage data, and other events that cause downtime or damage. Because preparation for disaster recovery begins long before a disaster actually occurs, the plan will address such issues as proper methods for backing up data, offsite storage, and alternate sites for restoring systems to their previous state.

A disaster recovery plan is incorporated into a business continuity plan, which identifies key functions of an organization, the threats that are most likely to endanger them, and creates processes and procedures that ensure these functions will not be interrupted long after an incident. In addition to the disaster recovery plan, the business continuity plan may also incorporate a business recovery plan that addresses...