"There are two types of companies: those that have been
hacked, and those who don't know they have been
hacked."-John Chambers, former CEO of Cisco. Mr. Chambers
probably didn't know how correct he was when he made that
statement years ago. Nowadays a breach of any data system can lead
to massive regulatory obligations.
It's well accepted that there is no perfect security system
in the world as is regularly shown to us by hackers. A few recent
examples include NotPetye and WannaCry. It is not a matter of if
your system will be comprised, but when. Isn't it better to
have the contingency set in place beforehand? Apart from ensuring
that a company can continue running with as little disruption to
its customers as possible, there may also be government agencies
that must be informed of the breach. Some countries impose massive
fines if the government isn't informed, especially in cases of
healthcare or financial information being inappropriately
accessed.
