HOW TO BUILD EMERGENCY PREPAREDNESS FOR CYBERSECURITY INCIDENTS