Governments have traditionally seen themselves as low risk tolerant due to the nature of the private information they carry. This can range from health data to personal data, and of course, criminal data, which all come with their own compliance requirements. However, governments cannot perform the same risk actions that private companies can – there is no often no ability to quickly fund new controls or terminate services altogether. As a result, it’s time to start accepting that there is more risk being tolerated at the government level and that the right decisions have to be made with that understanding.