A data backup is the first step in contingency planning. Without data, there is nothing to process. “No backup, no recovery”. Backup for hardware should be taken care of next. Formal arrangements must be made for alternate processing capability in case the need should arise. Operating systems and application software should be taken care of afterwards.
Source: VALLABHANENI, S. Rao, CISSP Examination Textbooks, Volume 2: Practice, SRV Professional Publications, 2002, Chapter 8, Business Continuity Planning & Disaster Recovery Planning (page 506).