Efforts to manage cyber risk must be transparent, structured, justifiable, and agile.