If an organization doesn't have an incident response plan, they best have a disaster recovery plan.
Dealt with too many organizations that have neither this year, and their ability to remain a going concern is uncertain following a cybersecurity incident.
Deep sigh.
7 months ago