I think Boards are becoming more savvy and not blindly relying upon CISO reports. They are asking questions and sometimes evaluating the CISO performance.