Does planning for cybersecurity failure include the concept of ‘crime scene’ ? Can you provide evidence to an external investigation sufficient to get justice or simply prove to insurance investigator that you met the policy requirements ? Should you be lobbying governments ? How does this drive your cyber spending – defense, microsegmentation, detection or evidence collection ?