Organizations never prepare for a crisis until there is a crisis. It just doesn't happen. The cost of preparing for a crisis is always higher than the probability-weighted cost of the crisis itself, even if the potential impact is bankruptcy, because the probability is always so low. The only organizations that prepare for crises are those whose sole purpose is to prepare for crises.

Regulators can also impose certain preparedness obligations on organizations, like power grid black start capability (the government or system operator pays generators a monthly fee to have more expensive equipment that's capable of black-starting).