What the board should ask senior management to help place assurance that cyber is being managed properly.