How to craft cyber-risk statements that work, with examples