Most cyber resilience training still teaches resilience as a technical and procedural discipline: how to detect faster, contain more cleanly, restore systems, and run a tighter incident review. All of that matters. None of it, on its own, tells a responder whether the incident they're managing has just started a legally binding clock, which authority needs to hear from them and by when, or what specific artefact a regulator will ask to see six months later.