In today’s world of interconnected computer-based information systems, cyber risk has become one of the critical risk factors impacting organizations. Indeed, several studies have shown that cyber risk (for exmaple, the probability of being the victim of a successful cyber-attack) is one of the, if not the, top risk concerns to senior executives in private, as well as public, sector organizations. Auditors have also recognized the critical nature of cyber risk to organizations, as evidenced by the American Institute of Public Accountants’ development of its cybersecurity risk management reporting framework. Cybersecurity risk is also a