@AviD The idiots who decided that it was OK to package malware with your music are not the security ops people who are having to clean up the current messes. So I deny that your analogy is relevant. :-)
@schroeder Not a pro, (we have FedRAMP certified customers we work with, so just passingly familiar) but there definitely are DR requirements. Looking at the baseline workbook, there are requirements around contingency planning and testing, alternate storage and processing sites, backups, and systems recovery and reconstitution.
all the snarky puns, wasted on Stack Exchange, when I could be working for Sony :P
@AviD How else am I supposed to pretend I know my shit? I could start talking in Latin but that's too academic I wouldn't make a cent on it but I could publish some papers...