Boards that get comfortable asking and acting on that question will reduce breach impact and set a new cyber accountability standard that’s grounded in design, not blame.