What some companies are doing:

• Capital One Bank, based in New Orleans, has set up an incident-response team made up of employees who work within the bank and in customer service. When a storm looms, team members in markets that may be affected are relocated to hotels and alternative workspaces and help plan operations. Continuity plans are regularly tested to make sure functions can continue.

• Dayton Ritz & Osborne, a 30-person insurance agency based in East Hampton, N.Y., has disaster preparations that include a $25,000 automatic electric generator, an off-site phone-answering service that incoming calls can be directed to and precut plywood shutters to protect the windows.

• Blue Cross and Blue Shield of Rhode Island, with more than 670,000 customers, has an incident-management team from information technology, finance, human resources and other departments that meets yearly to assess plans and go over a mock disaster. It has an offsite backup computer facility in Sterling Forest, N.Y., with all the data needed to continue processing claims.

"Being the major health insurer for the state, we owe it to our customers to have our operations up again if a disaster happens," says Tom Bovis of the Providence-based health insurer. "This is critical to people."

But serious gaps in disaster planning remain. Some companies have plans but have not communicated them to employees or practiced what to do in a mock disaster. And others have done nothing. About 25% of organizations have not communicated or tested their plans, according to a new survey conducted by the Brookfield, Wis.-based International Foundation of Employee Benefits Plans.