Hacked companies had backup plans. But they didn't print them out before the attack.

... in risk conversations in board rooms as legal risk or financial risk – the CEO see the CISO as often as they see the financial director," Cameron said.
read source