Has your governing body formally adopted a cybersecurity program or policy?

Formal approval makes responsibilities and funding decisions clear and auditable.