How should boards look at cyber security risk.