"To most corporate boards, IT security is purely a function such as HR or payroll." . . . . .