Afterwards is always too late. An effective recovery plan should read like a triage of your personal or organizational computing needs. Focus on restoring critical functions as quickly as possible, even if others must remain offline. By implication, only a thorough analysis of users and their needs can serve as the basis for an effective recovery plan. For server administrators, merely having a plan is not sufficient.
Planning is vital, but it's no substitute for practice.
It's important to include simulated recovery drills into your routine server maintenance schedule. In any security system, the attacker always has an undeniable advantage. After all, it's impossible by definition to plug undetected security holes. Similarly, it' s impossible to monitor and scrutinize every byte of data transmitted across a network without rendering that network unusable. Ultimately, effective network security is about minimizing exposure and mitigating damage, not disabling your network connections.