C-level responsibility in cybersecurity