A cyber assessment is not a cyber audit