Companies have a way to go give their boards confidence, that they are managing cyber risk.