I would start by doing a business criticality analysis. I would first determine a matrix of general business areas with specific IT processes attached.
Consult with the business owners, and find out a "preferred" no outage greater than "x" hoursor days, and an "under no circumstances can be out more than 'x' hours or days" for each process.
Then take the most critical processes, and define what would be required to support those processes if anything failed. Start small by thinking about individual components (servers, routers, etc...), then expand the scope to cover LAN, WAN, buildings, sites, etc....
For each "backup", you must then define the most cost-efficient way to meet the recovery requirements as defined in the first step.
The most critical individual task I can recommend is to make sure that you have an off-site backup of ALL data.