If you don't shut down and an second and/or third incident then happens in a coordinated attack, it's very easy to say "Why didn't you shut down? Couldn't you see that we were under attack?"
That's "what's the point of using acronyms when you can just write out the full sentence?"
Well, you could ask the National Aeronautics and Space Administration, the Central Intelligence Agency, or even consult with the Massachusetts Institute of Technology. Perhaps you can send them JavaScript Object Notation using the Asynchronous Javscript and Extensible Markup Language standard over HyperText Transfer Protocol?
</s>
I use acronyms to reduce the cognitive overhead of reading, and (relevant to this discussion) make otherwise offensive terms acceptable in a broad range of environments (snafu, CYA, OMFG, WTF, etc). I'm sorry you haven't run across CYA before (though that might be a good thing), but it's not a terribly uncommon acronym either.
I have no intention of belittling the incident, but I fail to see how shutting everything down is a proper response to any incident of less than catastrophic scale.
I take that back, I can see a reason: CYA. Nobody would want to be the one who makes the decision to keep the metro system running and have a second attack occur. I'm still not convinced that CYA is a sufficient reason, however.