Being hit with a cyber-attack is bad. Not having a recovery plan is worse