What do you believe is the biggest programmatic issue that private industry will face when instituting a cyber resilience program? What will be the challenges?

What do you believe is the biggest programmatic issue that private industry will face when instituting a cyber resilience program? What will be the challenges?