We feel a sensible Disaster Recovery and Business Continuity plan starts with a platform that can be "Air Gapped". Using low-cost modern equipment, it is trivial to maintain a complete offsite replica of a production environments. Having a DR environment that can also serve as a backup restoration area is not overly complex.
“Solid documentation stored in a modern CMS can guide this process”
An air-gapped systems can also be useful when there is a need to maintain legacy software, while limiting security risk with exposure to pubic networks.
"We're looking at you Drupal."
While we're on the topic, Anti-virus software can be helpful to have around. CLAMAV has a lot of community momentum; it's been around for years. It's licensed under GPL, so "Good Stuff".