How does your board measure cyber resilience