It’s always been there. The Marriott breach highlights that a cyber risk assessment should be part of the due diligence process.