A big risk is from third-party dependence for services, with some organizations not testing continuity plans should a breach happen, says Lee Kim, senior principal of cybersecurity and privacy at HIMSS.