What good looks like

• Governance, risk and compliance are understood organizationally as adaptive controls that consider context and are not carved in stone

• Long-lived GRC teams are assigned long-lived product teams, working under shared context and shared, customer-first outcomes