Differences between this expected configuration and your current state can provide an indication that an intrusion has occurred. You will be unable to determine the full extent of the intrusion and the damage it has caused. You will also be unable to tell whether or not you have completely removed the intruder from your systems and networks. This will significantly increase your time to recover. Your organization may be subject to legal action.
Intruders make use of systems they have compromised to launch attacks against others.
If one of your systems is used in this way, you may be held liable for not exercising adequate due care with respect to security. Your organization may experience lost business opportunities and its reputation may suffer. If you are adequately prepared and if you have the necessary policies and procedures in place to detect signs of intrusion, then you can mitigate your risk of exposure to intrusion and mitigate possible damage to your systems. It is likely not feasible to protect all assets. You have a documented disaster recovery policy and procedures that include determining what assets are critical to protect and with what priority.