Building effective cybersecurity programs that auditors love.