What makes for good governance in cybersecurity? Compliance can be a blessing and a curse, it all depends on an organization's culture.