The severity and damage can vary, but some kind of breach is inevitable. When that happens, you won’t have time to figure out what to do. You need an action plan that can be implemented immediately, covering everything from how you stop an attack to how you notify customers whose information may have been compromised.
The costs relating to any digital risk can be material, and most organizations do not calculate the risk of such exposure. It is the job of the CFO to ensure that the business appropriately reflects those risks in the 10-Q and 10-K filings.