No chief information security officer (CISO) or CIO wants to face a cybersecurity breach under their watch. In my time leading two cybersecurity firms and as a Microsoft executive, I’ve watched many executives during and after incidents and guided them through response. The common thread: CISOs were unprepared for the broader war beyond technical recovery.

Boards most often let CISOs go for failing to lead effectively in incident response, not for their preparation before an incident. Here is why:

1. Assuming You’re Only Fighting A Technical Battle With The Threat Actor

Breaches impact every part of a business. Preparing for a breach means planning for technology downtime, threat hunting, testing backups and updating incident response plans (IRP) (among other critical preventative activities). Except for communication plans (which are few and far between), those steps check and double-check security technology and miss process or people gaps.

CISOs face enemies on many fronts. You could hire the best digital forensics and incident response (DFIR) team on the market, and legal or interpersonal complications could still trip you up. No matter the risk, your board will watch how you lead and communicate in the crisis.

2. Assuming A Breach Will Only Require Operational Leadership

Too many CISOs and CIOs don’t know how to lead through something like this. They have no project plan for a breach. You should assume that at every level, you and your team will need to pivot. It’s like a choose-your-own-adventure novel: Each decision during breach response could lead to a different outcome.

There’s always the center of the attack: The adversary deploys ransomware, launches a denial-of-service attack, accesses and exfiltrates sensitive data or all the above. But when the incident response team returns with its first report, the CISO must assume the first answer is likely wrong. Your first read of the attacker’s entry point or method will change over time as you gather more information.

If an adversary catches your response team investigating, it could escalate the negotiation process into something much worse. I’ve watched businesses with yearly revenue over $7 billion either have confidential data leaked or experience wide-scale denial-of-service attacks.

3. Assuming Full Disclosure Is Always The Right Answer

CISOs and CIOs must lead their in-house technical team, internal and external legal counsel, PR firm, forensic consultants, law enforcement, executives, CEO and board. Most have never had to do any of this during a crisis, and most don’t anticipate they ever will. But not all communication with these entities is appropriate, depending on the timing and legal implications. This may sound like you’re hiding something, but understanding what and when to communicate with anyone is critical.

You need to communicate confidence and the completeness of your plan to executives, and learn to speak their language. This takes practice and complex table-top exercises—not the run-of-the-mill kind—to set the stage long before real-life communication needs to take place.

When you share breach updates with your CEO, remember his or her fiduciary responsibilities to the board and customers. As appropriate and advised by an experienced cybersecurity attorney, plausible deniability about the details of the breach 36 to 48 hours after may protect your CEO and your company from unnecessary legal action.

4. Assuming The FBI And Department Of Defense Operate Like A Business

Depending on size, industry, private-public status and the identity of the threat actor, CISOs may have to involve the Federal Bureau of Investigation (FBI). But when is it appropriate to bring them in, and when shouldn’t you? When does the FBI care, and when shouldn’t they care?

An enterprise consumer packaged goods (CPG) client I guided through a breach around the holidays several years ago issued statements soon after the breach and again six months later. Both press releases read very differently. Why? In cases of national security, the FBI may direct a company during its initial breach to calm consumer fears (which poses a national security risk due to the potential for economic collapse).

Follow cyber-specific legal guidance on industry regulations. Work with an advisor to distinguish a proper course of action. Remember, the Department of Defense’s first priority is national security and stability, not your business. Disclosing incident details at the right time and place is crucial for recovery and for law enforcement’s success in capturing cybercriminals. Feeding requested intelligence to law enforcement could help you and prevent future attacks, so always comply with those requests.

Surviving A Cybersecurity Breach

CISOs and CIOs facing a breach have a very difficult job, but not an impossible one. Preparing ahead of time increases your chances of the best outcome from the worst-case scenario. I recommend engaging experienced cyber-specific legal counsel, practicing for incident response and educating your employees. Consider drafting a communication and public relations plan.

Above all, firsthand experience in crisis situations is invaluable. Pursue a cybersecurity advisor who can confirm, direct and withstand the firestorm with you so you have a fighting chance of protecting your company and keeping your job.

This article was originally published by the Forbes Business Council.