The annual AT&T Business Continuity Study shows almost one-third of businesses still don’t think planning for business continuity is a priority, and have not planned for how they would recover from a natural or man-made disaster. Even companies that have such a plan may not be prepared, however, as more than half admitted they haven’t actually tested the plans made on paper.

Businesses are becoming more concerned about cyber security, however, as 82% of businesses said they have a plan for addressing man-made attacks on their networks.

The annual study surveys 1000 C-level IT executives in 10 markets, which change from year to year, and the results are published to help improve awareness of the need for business continuity planning, said Jerry Shammas, AT&T executive director, business continuity and recovery services.

The survey shows “some businesses may have a false sense of security – they are becoming complacent,” he said. “About 15% of those companies believe they have a sufficiency of systems in place. Another 14% think the probability of disaster cause business disruption is very low and 13% think the probably of a major disaster is small.”

Not surprisingly, the amount of disaster preparedness varied by market, and was much higher in markets such as New York City and Houston, where a major disaster has occurred.

“What surprised me was that markets like Los Angeles, Minneapolis-St. Paul and Cleveland rank at the bottom of the list,” Shammas said. “Cleveland ranked 10^th on all three business-ranking components.”

When it comes to cyber-security, nearly three-fourths of those surveyed said viruses and worms are a threat, 45% cited hackers and 37% were concerned about spam.