Data protection and IT security is clearly of utmost importance. But when it is accepted that you will not have unpenetrable defences, having the right crisis management, and disaster recovery in place is almost more important to preserving reputation and shareholder value.