what should we report to the board about cyber