Which of the following is true regarding actions the board and the CAE should take regarding cybersecurity?

1. The board should verify that management has established relationships with the appropriate national and local authorities responsible for cybercrime responses.

2. The board should meet with the organizations chief information security officer at least once a year.

3. The board should be made aware of major successful data breaches, but not each major data breach attempt.

4. The board should understand the cyber risks associated with third-party service providers.