4 questions every CISO should be asking about the metaverse