To protect critical infrastructure, organizations must go beyond prevention and build cyber resilience that ensures continuity when—not if—a cyberattack occurs.