Most of our managed services contracts start on an existing estate, not a blank page. The takeover phase lasts a few weeks and always follows the same order.
Inventory. What actually runs, not what the documentation describes. The gap between the two is the first thing we measure.
Breaking points. Backups never restored, components past end of support, dependencies on a single person, shared credentials. These four are handled before anything else.
Bringing it under monitoring. Instrumentation, thresholds, on-call. From that point the platform is held.
Describing it as code. Progressive description of the environment to make it reproducible. That is what turns disaster recovery from an uncertain operation into a rebuild.