Creating the right culture is key to success because even a cybersecurity department of 'yes' needs to have some red lines for policy enforcement, with a core approach to suit the company’s context.