A company that's expecting a cyberattack but hasn’t actively prepared for it risks making the hardest decisions at the worst possible moment