20% of CISOs are concerned about their organisation's ability to handle a cyber crisis because of the lack of incident response planning.