Major institutions such as banks have a long history of establishing redundant systems to survive cyber-attacks. But as severe cyber-attacks hit companies, governments, utilities, and hospitals with greater regularity, it’s becoming abundantly clear that organizations now require two playbooks: the one they already have for common cyber threats like malware, phishing, and denial-of-service attacks; and a new one that covers something even worse. They must prepare for cyber crises that could cripple not just their own operations, but spread through their industry and across others as well.