I'd actually argue that at least as important (if and only if this isn't the case) would be 3) Not having extensive WORM backups and a plan to simply nuke and

I'd actually argue that at least as important (if and only if this isn't the case) would be 3) Not having extensive WORM backups and a plan to simply nuke and repave everything, or even quickly substituting in duplicate clean hardware kept cold for emergency. This should include (to the extent possible) running everything isolated while infection source is determined. I mean yes, both your points are important too though with caveats. For 1, it's not necessarily the case they had mission critical systems on the Internet. There are significant ways that malware can cross even decent air gaps (let alone softer protections). And of course sometimes even mission critical equipment does in fact need to have a WAN link, though in that case I'd hoped it'd have protects wrt their intranet. For 2, yes to that also if Boeing just plain didn't patch when they could have. But particularly when dealing with a lot of heavy duty industrial control applications sometimes enormously expensive hardware will only work with very old systems and/or have other baroque and fragile dependencies. Perhaps more to the point, there are zero days out there too, and Boeing should be ready even if this was an entirely unknown vulnerability rather then an old one. Or for that matter if a bunch of their critical computers simply exploded into flame. At their level I'd expect a very concrete and specific action plan to simply bootstrap from scratch in a worst case and bring themselves back up from mere computer failure within a few days at worst and with a limited amount of data lost. Of course, like I said at the start, maybe that is in fact what they're executing, the article was light on details. If they are having to do a "swap in fresh hardware/reimage/restore while preventing reinfection" scenario across tons of systems in a hurry that would indeed be an All Hands On Deck critical event, albeit one with hopefully a relatively deterministic time frame. While it wouldn't stun me to see even a big engineering oriented company like that mess up here in a facepalm way I also don't want to jump to conclusions too fast. Clearly something has gone wrong, but if they have a worst case plan all in place ready to go and practiced and are now executing, it wouldn't be good they'd have to but that's what worst case plans are for.