Steve - I agree. The higher up the chain of command we go the simpler and more clear the message needs to be. And, everything needs to be discussed in terms of risk to the business in business terms, specific to the business goals. Otherwise, as you say, they will see it as a "cyber" problem not a 'business' problem.