The governance that actually gets followed

Governance that arrives after an incident is a document nobody reads, not a framework anyone uses.

The governance that actually holds is proportionate to real risk, has named individual ownership rather than a committee, and is built into the architecture from the start rather than bolted on afterward. That's a smaller list of controls than most compliance checklists assume — and a much more durable one.