Engineering risk registers that drive board-level cyber decisions in Critical National Infrastructure operators.