In a recent survey conducted by Gartner, more than half the 359 participants from the US, Canada and the UK said they planned for natural disasters, power outages, fires, IT outages, computer virus attacks, and failures at key service providers. And 50 per cent of the respondents said they planned for terrorist attacks.

But the survey also found that less than half have plans for dealing with labor strikes, civil unrest, denial-of-service attacks or pandemics. And only 45 per cent have plans for long-term facility outages -- that is, outages lasting more than a week.

Given these findings, Gartner analyst Roberta Witty questions whether disaster plans are adequate, considering the fact that some recent events, such as Hurricane Katrina, took out power for much longer than a week. Witty says organizations also fail to adequately plan for disruptions in services provided by third parties.

Companies are taking note, though. Forrester analyst Stephanie Balaouras says Hurricane Katrina was a louder wake-up call for businesses than the September 11 terrorist attacks. She says most companies don't operate in major urban areas or near landmarks that could be terrorist targets, but they do see themselves as vulnerable to weather-related catastrophes and other natural disasters.

But Balaouras points out that the vast majority of business disruptions aren't caused by big events like hurricanes. It's the more mundane scenarios, such as power outages, IT failures and human error, that are more likely to bring down a whole IT infrastructure.

Companies shouldn't focus on a specific event, however, Balaouras says. They need to plan for the resulting disruptions. After all, anything from wildfires to floods can knock out power, take out infrastructure and scatter workers.

"This really needs to become part of change management," Benvenuto says. "Whenever you add a new process, you need to think about how it affects disaster recovery."