Information security is about the protecting the integrity,confidentiality, and availability of information. Without being able to protect the information and make it available to those who require it even during a natural disaster could mean the end of a business.
I helped to develop Business Continuity Plans where one of the critical requirements was that certain information had to be (by law) available 24 hours a day, 7 days a week, 365 days a year. There was no allowed down time, even during a natural disaster such as a horrific earthquake.
There was no simple solution - business impact analysis had to be conducted. Information is not only being stored on computers. It is often scattered about and not just found in one centralized location. Identifying the critical information which is necessary to keep the business functioning is very tricky. Once the identification of critical systems and components is completed and reviewed. There is additional risk assessment which needs to take place.
During large natural disasters, such as earthquakes or large tornados, there is a high probability that the physical premises will be out of commission for some time. There were even examples where there was no building left or the team had limited access (15 to 20 minutes) to gather what was needed before no one would ever be allowed back into the building. Also, you could plan on some delays, because it had to be determined the buildings were sound enough for anyone to access them.
If it is a large disaster, where do you go or how is the continuity of operations accomplished. Local employees are certainly going to be affected by the disaster as well. It could be weeks before they are in any position to come back to work. In the case of one BCP I worked on, the employees were also faced with their homes being totally destroyed or they only had a few minutes to enter their homes and gather up belongings. Many told me they grabbed clothes and toothbrushes, and identification documents and had to leave other personal items behind.
So part of the technical strategy can be developing a multitude of options depending on the Risk Assessment. There can be plans for cold sites, warm sites, and hot sites depending on the budget. Strategies for protecting identified critical servers and hardware with RAID, clustering, and load balancing, focusing on fault tolerance. Of course, there is protection of data through backs up and plans for restoring critical data and having it available to be utilized by the cold sites, warm sites, and hot sites, ensuring confidential documents are protected and available to those who require the information at all times.
Once in place, all of these strategies, plans, and policies need to reviewed, maintained, and verified. It requires a lot of personnel to be involved and to be aware. The one constant thing is change. New hardware and software solutions are being implemented. Business requirements and laws are being modified. I can certainly understand why it is mentioned. Information security is about the protecting the integrity, confidentiality, and availability of information.