Cybersecurity is now part of regular executive discussions and is being allocated budgets accordingly. Chief information security officers (CISOs) and their teams must exhibit business acumen in spending these budgets and demonstrate how they're reaching an appropriate state of cybersecurity readiness. In this report, we examine how CISOs are doing both.