We have the usual HR, legal, compliance etc. But product teams exercise enormous autonomy, arguably to a fault. A few years back an R&D mechanism was introduced

We have the usual HR, legal, compliance etc. But product teams exercise enormous autonomy, arguably to a fault. A few years back an R&D mechanism was introduced of pushing triaged security issues directly into team backlogs. Something close to a riot broke out. R&D leadership otherwise pretty much don't interfere. Their main business is explaining our strategy, keeping the lights on and teams connected and adjusting allocations between different product and component teams.