What the boards of directors of Canadian firms should know about cyber risk.