Consider the damage caused by the 2014 hack that relates specifically to Sonys critical systems being targeted.

• What should the maximum time the organization can afford to have the critical system offline? What resources would the organization require to continue business processes despite the system being unavailable?

• What backup systems should be in place in the event of such an attack? Are these backups also subject to attack?