Three years after Sandy wreaked havoc on the U.S., most companies still are not reporting on their readiness to deal with similar disasters.