• IT averages only one large-scale recovery exercise every 10 months in preparation for cyberattacks or natural disasters.