Being ready for 'when, not if' a cyber attack happens : vima