Security Metrics That Answer Board Questions