Managers are increasingly coming to recognize that disaster recovery planning is an essential function in the management of a business. Studies have shown that about 80 percent of companies that do not have a workable recovery plan will fail within 1 year of suffering a major disaster. Planning for disasters is similar to planning against commercial risks. It requires the business to identify the nature of the threat, the level of risk, and the consequence for the business. Focusing on the consequences of a disaster rather than its cause reveals that there are usually many common factors. There are three caveats: (1) the nature of each threat needs to be considered; (2) the plan should cater for the “worst case” scenario; and (3) the plan needs to be flexible. The three stages considered in planning for a terrorist bombing or other disaster are the incident stage, the recovery stage, and the continuity stage. The incident stage involves spreading the alert, establishing control, moving staff and public to a place of safety, and reporting to headquarters. The recovery stage begins as soon as the consequences of the incident become clear, and involves achieving specified objectives by bringing the necessary resources into operation within the predetermined time-scale. The continuity stage involves re-establishing the business in changed circumstances. Precautionary measures and response measures for each are considered. Drawing up a business continuity plan requires an investment of resources. The investment should be proportionate to the size and/or complexity of the business. The first requirement for effective Business Continuity planning is to secure the commitment of the management at Board level. Case studies of terrorist bombings in England, including Bishopsgate 1993 and Manchester 1996, are analyzed. 5 footnotes, 1 chart