How should CISOs brief the executives?