Samantha just agreed to serve on the Board of Directors of Breaches 'R Us in the wake of a cyber attack. She is concerned about the possibility of future data breaches and wants to ensure that the organization is taking cybersecurity seriously moving forward. She is also concerned about breach of fiduciary duty litigation if the Board does not make significant changes. She reaches out to a friendly consultant (you) for advice. What are at least two basic steps that you would suggest Samantha suggest to the Board to ensure that they are fulfilling their cybersecurity advisory oversight responsibilities