With Chertoff's comments at RSA yesterday, businesses will be significantly impacted in efforts to defend against cyber attacks. Cyber attacks have emerged as a significant business risk! As such it is a SOX issue. The question is what do we do about it? How at risk are we? How do we manage the risk? Who will be the ones to give us this guidance? That the million $ question.

I worked on a year long project that accessed the offensive and defensive capabilities of 168 countries around the world. To answer the other poster's question, organizations need to look at each country of operation, use our defense capabilities score and determine the financial and operational impact if that country were to experience a cyber attack. At that point you can begin you business continuity planning for operations in high risk areas.