How CISOs Can Effectively Assess the Health of Cybersecurity Programs