A board meeting is not a finish line. For CIOs, the real security work is turning questions, concerns, and executive alignment into an ongoing risk conversation.