what auditors look for in a cybersecurity program