State governments need to assemble plans for treating cyberattacks more like disasters, a new paper by the National Governors Association recommends.