Understanding the uncertainties of cybersecurity: Questions for chief information-security officers