Every cybersecurity governance program I have seen succeed started with the same question: what risk is this business willing to accept? It sounds simple. In practice, answering it forces alignment across executive leadership, legal, operations, and IT in ways that no technology deployment ever will. Getting that answer and documenting it clearly is the foundation on which everything else is built. This post sets out how I approach building an enterprise cybersecurity governa