Assume you were just hired by a major publicly traded firm and have been assigned to work for the firm's CFO (Chief Financial Officer).

During a recent meeting, the CFO mentions the firm's concern with cybersecurity risk. Toward the end of the conversation, the CFO turns to you and says:

What do you think is the best way to manage our firm's cybersecurity risk? Rather than giving the CFO an ad hoc answer, you state that you would like to think about your answer to that question.

The CFO says fine and asks you to prepare a memo by the end of the week explaining how you would suggest the firm go about managing its cybersecurity risk. 

Write a short memo (e.g., no more than 200 words) explaining how you think your firm should manage its cybersecurity risk.