CEOs should actively communicate the importance of cybersecurity, set security goals aligned with business objectives, and support the appointment of a Security Program Manager. The Security Program Manager is responsible for tasks such as training employees, creating and maintaining the Incident Response Plan (IRP), and conducting tabletop exercise drills to improve response capabilities.