there are some cyber risk questions that SHOULD only have YES answer?