Boards need to employee members with real and deep cyber risk management experience.