Why planning and rehearsing your recovery from an incident is as vital as building your defences