What is needed is a straightforward assessment of assets -- data and infrastructure -- to determine what needs to be protected, supplemented by an estimation of the cost of an interruption of access to assets (from whatever the cause) for 24, 48 and 72 hours. The sources for collecting this information are business stakeholders: so, yes, you will need to talk to end users (audible groans expected.) In this presentation by DR planning veteran Jon Toigo, you'll get a better idea of the process for doing a good job with upfront analysis.