New guidance helps CISOs communicate with Boards to improve oversight of cyber risk.