Enterprises now must describe their management’s expertise in cybersecurity. But what exactly does that entail?