A problem all boards face with cybersecurity risk management is providing adequate oversight and assurance over complex cybersecurity risks.