Many disaster recovery planning efforts get bogged down when planners become preoccupied with identifying all of the risk scenarios that might impact company operations. Truth be told, enumerating natural and man-made hazard potentials, then assigning quantitative values to their likelihood of occurrence, is a fool's errand.

What is needed is a straightforward assessment of assets -- data and infrastructure -- to determine what needs to be protected, supplemented by an estimation of the cost of an interruption of access to assets (from whatever the cause) for 24, 48 and 72 hours. The sources for collecting this information are business stakeholders: so, yes, you will need to talk to end users (audible groans expected.) In this presentation by DR planning veteran Jon Toigo, you'll get a better idea of the process for doing a good job with upfront analysis.