“The victim cited gaps in cybersecurity knowledge and the wide range of possible scenarios as reasons for failing to adequately incorporate cybersecurity into emergency response planning.”

Or, “It seemed hard, so we just didn’t do anything at all.” 🙄

https://www.us-cert.gov/ncas/alerts/aa20-049a