Many business owners ask this question after an incident. The better time to ask it is before one happens. Recently, a company chose not to implement recommended security controls. They were concerned about cost and disruption. Instead, they moved forward with another IT firm that did not require those protections....
