The risk workstreams dictate the governance structure which is made up of information security, security operations, resilience, IT security, content protection, people, regulatory and business risks.