From the fire service... parallels to GRC. If an organization can't be trusted to do basic hygiene tasks and be able to document it via GRC, how well do you think they will respond when threat actors are inside their systems?