Turning cyber risk into structured security governance.