Our premise is that cyber risks need to be treated as any other risk and not be kept confined to the IT department.