Cyber risk mitigation requires board oversight.