If an accounting department's computer system was compromised, who should make the decision about when that system is put back into production?