The hard part is not the CEO, it's the CISO